WEBINAR | From Deal to Defense: Unifying Cybersecurity Post-M&A
Reduce Alert Noise and False Positives
Boost your team's productivity by cutting down alert noise and false positives.
Automate Security Operations
Boost efficiency, reduce burnout, and better manage risk through automation.
Dark Web Monitoring
Online protection tuned to the need of your business.
Maximize Existing Security Investments
Improve efficiencies from existing investments in security tools.
Move your security operations beyond the limitations of MDR.
Secure with Microsoft 365 E5
Boost the power of Microsoft 365 E5 security.
Secure Multi-Cloud Environments
Improve cloud security and overcome complexity across multi-cloud environments.
Secure Mergers and Acquisitions
Control cyber risk for business acquisitions and dispersed business units.
Solve security operations challenges affecting critical operational technology (OT) infrastructure.
Force-Multiply Your Security Operations
Whether you’re just starting your security journey, need to up your game, or you’re not happy with an existing service, we can help you to achieve your security goals.
Detection Investigation Response
Modernize Detection, Investigation, Response with a Security Operations Platform.
Locate and eliminate lurking threats with ReliaQuest GreyMatter
Find cyber threats that have evaded your defenses.
Security metrics to manage and improve security operations.
Breach and Attack Simulation
GreyMatter Verify is ReliaQuest’s automated breach and attack simulation capability.
Digital Risk Protection
Continuous monitoring of open, deep, and dark web sources to identify threats.
GreyMatter Phishing Analyzer removes the abuse mailbox management by automating the DIR process for you.
The GreyMatter cloud-native Open XDR platform integrates with a fast-growing number of market-leading technologies.
Unify and Optimize Your Security Operations
ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints.
Brands of the world trust ReliaQuest to achieve their security goals.
Learn how to achieve your security outcomes faster with ReliaQuest GreyMatter.
The latest security trends and perspectives to help inform your security operations.
Industry Guides and Reports
The latest security research and industry reports.
Catch up on the latest cybersecurity podcasts, and mindset moments from our very own mental performance coaches.
A deep dive on how ReliaQuest GreyMatter addresses security challenges.
The latest white papers focused on security operations strategy, technology & insight.
Current and future SOC trends presented by our security experts.
Events & Webinars
Explore all upcoming company events, in-person and on-demand webinars
From prevention techniques to emerging security trends, our comprehensive library can arm you with the tools you need to improve your security posture.
Get the latest threat analysis from the ReliaQuest Threat Research Team. ReliaQuest ShadowTalk Weekly podcast featuring discussions on the latest cybersecurity news and threat research.
ReliaQuest's ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk's hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week's top cybersecurity stories.
February 20, 2024
We bring our best attitude, energy and effort to everything we do, every day, to make security possible.
Security is a team sport.
No Show Dogs Podcast
Mental Performance Coaches Derin McMains and Dr. Nicole Detling interview world-class performers across multiple industries.
Make It Possible
Make It Possible reflects our focus on bringing cybersecurity awareness to our communities and enabling the next generation of cybersecurity professionals.
Join our world-class team.
Press and Media Coverage
ReliaQuest newsroom covering the latest press release and media coverage.
Become a Channel Partner
When you partner with ReliaQuest, you help deliver world-class cybersecurity solutions.
How can we help you?
A Mindset Like No Other in the Industry
Many companies tout their cultures; at ReliaQuest, we share a mindset. We focus on four values every day to make security possible: being accountable, helpful, adaptable, and focused. These values drive development of our platform, relationships with our customers and partners, and further the ReliaQuest promise of security confidence across our customers and our own teams.
A number of extortion actors were detected accessing unauthenticated MongoDB installations and replacing their contents with a ransom note, usually containing an email and Bitcoin address and the usual “we have your data” message. The earliest activity we observed was from December 20, 2016 at which time there appeared to be only one actor conducting the activity using the nickname “harak1r1”. Since then, the number of actors involved (or at least the number of unique identifiers) increased – on January 10, 2017, that number was at 11. Approximately half of these actors had received ransom payments (between 0.2 BTC and 0.5 BTC) based on the transactions made into their Bitcoin addresses. Their overall earnings were relatively low, with the highest at around $7,962 USD. This isn’t bad considering the low capability, low amount of resourcing required and the short duration of the activity. When last checked, the reported number of affected instances was between 27,000 and 28,000.
On January 6, we set up a honeypot running a MongoDB installation without authentication. At some point over the following weekend it was ransomed, with the given email kraken0[at]india[.]com). The time between establishing this honeypot and a ransom note appearing, coupled with the reported number of infected installations over a couple of days, showed the pace at which this activity was occurring.
Fig 1 – A screenshot of the ransomware demand from our honeypot
On January 11, a Pastebin post by an actor purporting to be “kraken0” uploaded an advertisement for “MongoDB ransomware” to the text sharing site Pastebin (see Fig 2). The advertisement for this purported ransomware suggested it was written in the c# coding language. The author of the post claimed the script could handle “1,000 IPs per second” and that this could be higher with the necessary infrastructure. The author claimed the CPU load of the script was low but that RAM was important if the operator was using a large list of IPs. A list of IPs was purportedly included in the source code.
Fig 2: A Pastebin post from January 11, 2017
Overall, the package offered included the “kraken” source code, 100,000 IP lists with open MongoDB installations and a mass MongoDB scanner. This was offered for $200 USD in Bitcoin and could be purchased via contacting the actor’s email address. We previously assessed it as almost certain at least some of the actors involved were using automated scripts to scan for Internet-facing, unauthenticated MongoDB installations, following which the contents would be replaced with a ransom note containing actor identifiers.
At the time of writing the identifiers associated with the “kraken0” actor were independently reported to have been discovered on 21,642 open MongoDB installations. Research into the Bitcoin addresses associated with the actor showed they had received a total of $7,962 USD spanning 95 transactions since January 7. The actor had withdrawn all of these funds from the address as at January 11. It was not confirmed if all of these transactions were ransom payments.
While we have not detected enough evidence to judge whether this was a genuine offering at the time of writing, the use of an automated script to identify open MongoDB installations is consistent with our previous assessments on this extortion activity. Some of the capabilities described by the actor were within the realms of possibility and, should they be genuine, provide some explanation as to the number of MongoDB installations the actor has managed to affect when compared to other actors conducting similar extortion attempts. However, the claims around the CPU load of the script and the contents of the offering could not be judged. The actor kraken0 has demonstrably received ransom payments from at least some of the affected victims, and if this is a genuine offering it would suggest the actor is likely intending on discontinuing their extortion activity and instead attempting to sell their tools.
We had previously assessed that the number of actors conducting the extortion activity would cause overlapping extortion attempts and reduce the viability of this method over time. This offering is a possible indication the actor kraken0 had decided the tactic they were using was no longer profitable or viable, or that the actor was attempting to take the ransoms they had received and disappear. It is considered less likely the actor intended to continue their activity after selling their tooling, as this had the potential to create unnecessary competition for a method that had been lucrative.