The MongoDB attacks began at midnight at 00:15 on February 12 and kept going around 30 hours in which many attacks were accounted for by GGSN. Victims are told to pay a 0.2 Bitcoin to deliver (approx. $200) to recover access to their content. The attacker is (likely) running from a compromised mail server which additionally fills in as HTTP(s) and FTP server. The second version offers the owners to visit the accompanying darknet site http://sognd75g4isasu2v.onion/ to recoup the lost information.”]
Source: https://gbhackers.com/ransomware-now-attacking-mysql-databases/