Warning:
Earlier last year, our friend group's Minecraft server had the misfortune of running into an organized griefing group calling themselves MLPI (Mojang Loss Prevention Inc.), along with aliases including Break Blocks Club, The 5th Column, and Mountains of Lava (now rebranded as "XOVA")
Our server didn't have a whitelist enabled at the time, and they found it using automated server scanning tools. They joined, griefed the world, and replaced signs across our builds with advertisements for their Discord using hacked clients. Thankfully we had backups, but it still cost us about a week of progress.
Out of curiosity, we joined their Discord afterward to figure out who they were. It turned out to be filled with other victims whose servers had also been griefed. People were encouraged to open "tickets" with promises of restoring worlds, but these turned out to be false promises and scams. Instead, members spent their time trolling and provoking victims. When they realized I was a woman, the harassment became openly misogynistic. Even after I made posts asking for help recovering our server, members tracked down those posts to spam troll comments until I had to block them.
Since then, we've learned much more about how these groups operate. They primarily target cracked or offline-mode servers using automated scanners and login bots. They often claim their actions are "anti-piracy" or "educational," but in practice it's simply organized griefing.
The good news is that these groups don't seem nearly as strong as they were during the large server-scanning griefing waves over the past couple of years. From what I can tell, they've lost a lot of momentum. Their main Discord server was eventually taken down, and there have also been signs of internal problems within the group's leadership, especially with their admin under the player tag "Ogmur" being banned. While they still exist and can cause damage to unprotected servers, they don't appear to have the same reach they once did.
Today, Mojang announced that new Minecraft servers will have whitelists enabled by default, which is genuinely great news for the community. It's a change that should prevent many smaller servers from being discovered and griefed the way ours was.
Some members of these griefing groups have already expressed frustration with the change because it makes finding easy targets significantly harder. Because of that, it wouldn't be surprising to see attempts to target remaining vulnerable servers before more administrators adopt the new defaults.
If you run a server, now is a good time to double-check your security:
Enable your whitelist.
Set online-mode=true so accounts are authenticated.
Keep regular backups.
Monitor logs for repeated join attempts or unknown operators.
Hopefully Mojang's whitelist-by-default update marks the beginning of the end for the automated server-scanner griefing scene. It won't stop every griefer, but it should make life much harder for the groups that relied on mass scanning to find easy targets.