Ongoing Cryptojacking Campaign<\/h3>\n
Exposed PostgreSQL instances are being targeted in an ongoing campaign aimed at gaining unauthorized access and deploying cryptocurrency miners. According to cloud security firm Wiz, this activity is a variant of an intrusion set first identified by Aqua Security in August 2024, involving the use of a malware strain known as PG_MEM. The campaign has been attributed to a threat actor tracked by Wiz as JINX-0126.<\/p>\n
Evolution of the Threat Actor<\/h3>\n
"The threat actor has since evolved, implementing defense evasion techniques such as deploying binaries with a unique hash per target and executing the miner payload filelessly \u2013 likely to evade detection by cloud workload protection platform solutions that rely solely on file hash reputation," researchers Avigayil Mechtinger, Yaara Shriki, and Gili Tikochinski noted.<\/p>\n
Extent of the Campaign<\/h3>\n
Wiz has revealed that the campaign has likely claimed over 1,500 victims to date. This indicates that publicly-exposed PostgreSQL instances with weak or predictable credentials are prevalent enough to become an attack target for opportunistic threat actors.<\/p>\n
Attack Techniques<\/h3>\n
The most distinctive aspect of the campaign is the abuse of the COPY … FROM PROGRAM SQL command to execute arbitrary shell commands on the host.<\/p>\n
![\"\"](\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhjK9HTBvuiSRI6SAJfiF_mZ5QPwOEunnNsN7jwiptOgo7JZuXmIQLIDjM7cnyXHOBGQ_fF8D_RUVO5XdquH6G_AGHztO-wHhlLWS98PhZtJvg56B8UZ3yCyTeCYVjra0VFRcV_OaxdcM_ofP_bYWGyZuJEuAVHdG7_DYkMgKy34AmIdnfz9tHEcQ_1vu0j\/s728-rw-e365\/crypto-miner-code.jpg\")
<\/a'><\/div>\nPost-Exploitation Activities<\/h3>\n
The access afforded by the successful exploitation of weakly configured PostgreSQL services is used to conduct preliminary reconnaissance and drop a Base64-encoded payload. This payload is, in reality, a shell script that kills competing cryptocurrency miners and drops a binary named PG_CORE.<\/p>\n
Additional Malware<\/h3>\n
Also downloaded to the server is an obfuscated Golang binary codenamed postmaster, which mimics the legitimate PostgreSQL multi-user database server. It’s designed to set up persistence on the host using a cron job, create a new role with elevated privileges, and write another binary called cpu_hu to disk.<\/p>\n
![\"Cybersecurity\"](\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjRFO5s2w2a-LYExVqmIzfz6CnCaWYIL8AQm2htTkuz9tueMoNcuhrPw0p-_fT9T5bOK9BonkBRKORSMcMUDyBSxRV1iT6whGPaUFHaJ6AiMmFzK5SQbYPumrOaibXKLYAo2i6Y237CYFzMKtqeMFzUFbVEb4ZRBRNQDz52duWN4i2gyE0YwRJipkSYSEbB\/s728-e100\/zz-d.png\")
<\/a><\/center><\/div>\n