Monero

Read

Researchers at Aqua Nautilus have uncovered a new malware that targets PostgreSQL servers to deploy cryptocurrency miners.
The cybersecurity firm has identified over 800,000 servers that are potentially vulnerable to a cryptojacking campaign targeting PostgreSQL, an open-source relational database management system used to store, manage, and retrieve data for various applications.
According to a research report shared with crypto.news, the so-called “PG_MEM” malware starts by attempting to gain access to PostgreSQL databases with <a href="https://crypto.news/hardware-glitch-keepkey-physical-brute-force-attacks/" target="_blank" rel="noopener noreferrer nofollow">a brute force attack</a> and manages to infiltrate databases with weak passwords.
Once the malware infiltrates the system, it establishes a superuser role with administrative privileges, enabling it to take full control of the database and block access for other users. With this control, the malware executes shell commands on the host system, facilitating the download and deployment of additional malicious payloads.
According to the report, the payloads contain two files designed to allow the malware to evade detection, set up the system for cryptocurrency mining, and deploy the XMRIG mining tool used to mine Monero (<a href="https://crypto.news/price/monero/" target="_blank" rel="noopener noreferrer nofollow">XMR</a>).&nbsp;
XMRIG is often used by threat actors due to Monero’s hard-to-trace transactions. Last year, an educational platform was <a href="https://crypto.news/educational-website-with-5m-monthly-visitors-hit-by-hidden-monero-miner/" target="_blank" rel="noopener noreferrer nofollow">compromised</a> in a cryptojacking campaign where attackers deployed a hidden script that installed XMRIG on every visitor’s system.
You might also like: <a href="https://crypto.news/what-is-cryptojacking-how-does-it-work/" rel="noopener noreferrer nofollow"> Decoding cryptojacking: what is it and how can you protect yourself? </a>
<h2 class="wp-block-heading" id="malware-hijacks-postgresql-servers-to-deploy-crypto-miners">Malware hijacks PostgreSQL servers to deploy crypto miners</h2>
Analysts found that the malware removes existing cron jobs, which are scheduled tasks that run automatically at specified intervals on a server and creates new ones to ensure that the crypto miner continues to run.
This allows the malware to continue its operations even if the server is restarted or if some processes are temporarily stopped. To remain unnoticed, the malware deletes specific files and logs that could be used to track or identify its activities on the server.
The researchers warned that while the campaign’s primary goal is to deploy the cryptocurrency miner, attackers also gain control of the affected server, highlighting its severity.
<a href="https://crypto.news/what-is-cryptojacking-how-does-it-work/" target="_blank" rel="noopener noreferrer nofollow">Cryptojacking campaigns</a> targeting PostgreSQL databases have been a recurring threat over the years. In 2020, Palo Alto Networks’ Unit 42 researchers <a href="https://unit42.paloaltonetworks.com/pgminer-postgresql-cryptocurrency-mining-botnet/" target="_blank" rel="noopener noreferrer nofollow">uncovered</a> a similar cryptojacking campaign involving the PgMiner botnet. In 2018, the StickyDB botnet was <a href="https://www.imperva.com/blog/archive/deep-dive-database-attacks-scarlett-johanssons-picture-used-for-crypto-mining-on-postgre-database/" target="_blank" rel="noopener noreferrer nofollow">discovered</a>, which also infiltrated servers to mine Monero.
Read more: <a href="https://crypto.news/3-5m-cryptojacking-case-sees-nebraska-man-face-up-to-30-years-in-prison/" rel="noopener noreferrer nofollow"> $3.5m ‘cryptojacking’ case sees Nebraska man face up to 30 years in prison </a>

Over 800k servers at risk due to new cryptojacking malware exploiting PostgreSQL

Table of Contents

crypto.news

Other articles published on Aug 21, 2024

Ethereum Sees Surge in On-Chain Activity as Institutional Investment Soars

Bitget Achieves ISO 27001:2022 Certification, Strengthening Commitment to Transparency and Security

3 Reasons Why XRP Can Hit $0.60 Today

Bitcoin Consolidates: Is an Increase or Decrease Coming in the Crypto Market? Analysis from Augus...

Mt. Gox shifts $700M in Bitcoin, first major move in 3 weeks

YieldNest launches new liquid restaking token

Join our free newsletter for daily crypto updates!