Harak1r1
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2016-12-30
- Last seen
- 2016-12-30
- Updated
- 2026-10-17 04:51
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Harak1r1, a threat actor operating from the United States, is known for exploiting misconfigured MongoDB databases to extort victims. In December 2016 the actor hijacked a MongoDB instance that held patient data for Emory Brain Health Center, demanding a Bitcoin ransom for the return of the information; the database was later restored from backups without payment. The incident involved the exposure of names, medical record numbers, addresses, birth dates, email addresses and cellphone numbers, affecting roughly ninety thousand individuals. No malware families or additional tooling are described in the public reporting, and the actor’s activity appears limited to this financially motivated ransom operation, with no publicly identified state affiliation or criminal consortium links.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.