United

Security

New malware has been uncovered that targets databases to install cryptocurrency mining software. Dubbed PG_MEM, the malware could potentially hit any of the more than 800,000 PostgreSQL-managed databases if they have weak passwords.
According to cloud-native cybersecurity company Aqua, PG_MEM is <a href="https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/" target="_blank" rel="noopener nofollow">installed</a> after a brute force attack finds a weak password on a PostgreSQL-managed database. PostgreSQL is a popular object-relational database management system that is used by databases with internet connectivity. There are well over 800,000 such databases, with almost 300,000 located in the United States and over 100,000 in Poland.
<h2 id="malware-sends-spare-compute-to-a-mining-pool">Malware sends spare compute to a mining pool</h2>
Once the threat actor has gained entry to a database, it creates a new user with login capability and high privileges. It downloads two files from the threat actor’s server and even manages to cover its tracks and block entry to other threat actors eager to exploit the database’s computing capacity. This could be happening often:
<blockquote data-ct-non-breakable="true">
 “This campaign is exploiting internet facing Postgres databases with weak password. Many organizations connect their databases to the internet, weak password is a result of a misconfiguration, and lack of proper identity controls. This is not a rare issue and many large organizations suffer from these problems.” 
</blockquote>
The malware, once operational, connects to a mining pool and uses the host’s computing resources, combined with those of other miners, to increase the chances of mining a new block.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-08/7723f409-0da9-410a-9aa3-25c14e5670d7.png" alt="Malware exploits weak passwords in PostgreSQL for cryptojacking" title="">
 <figcaption style="text-align: center;">
 PG_MEM attack flow. Source: Aqua Security
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/windows-tool-targeted-hackers-crypto-mining-malware">Windows tool targeted by hackers deploys crypto-mining malware</a>
<h3 id="a-growing-problem-or-solution">A growing problem — or solution</h3>
The use of malware to mine cryptocurrency <a href="https://cointelegraph.com/learn/what-is-cryptojacking-a-beginners-guide-to-crypto-mining-malware">is known as cryptojacking</a>. Cryptojacking malware can be installed on personal computers as well. It is becoming more frequent. Cointelegraph noted that crypto-malware attacks <a href="https://cointelegraph.com/news/what-is-crypto-malware-and-how-to-detect-it">rose by 400% year-on-year</a> in the first half of 2023.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-08/831a54e4-aa5d-495a-9ee0-9c3790793f24.png" alt="Malware exploits weak passwords in PostgreSQL for cryptojacking" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/AquaSecTeam/status/1826341822517707093" target="_blank" rel="noopener nofollow">Aqua Security</a>
 </figcaption>
</figure>
Unused capacity can be harnessed by rightful hardware users for mining or other uses. Decentralized cloud infrastructure provider Aethir, for example, <a href="https://cointelegraph.com/news/aethir-decentralized-gpu-network-revenue-growth">operates a GPU-as-a-service</a> decentralized physical infrastructure network (DePIN) that sources compute from tier 3 and tier 4 data centers to provide inexpensive, scalable computing service to its clients.
Magazine: <a href="https://cointelegraph.com/magazine/ivest-hacked-sinkclose-affects-amd-devices-usdt-phishing/">Weird ‘null address’ iVest hack, millions of PCs still vulnerable to ‘Sinkclose’ malware: Crypto-Sec</a>

Malware exploits weak passwords in PostgreSQL for cryptojacking

Table of Contents

Cointelegraph

Other articles published on Aug 21, 2024

Analysts Predict Top 5 Memecoins Poised for a New Supercycle

Playdoge Investors Join New PlayDoge Rival Before It Reaches Stage 4 of ICO

Miami Heat Jimmy Butler and Ben Armstrong Agree to Pay $340,000 to Settle Binance Lawsuit

What is Telegram Native DOGS Memecoin?

Aptos Foundation teams up with Web3 streaming platform

Analyst Predicts Bitcoin Surge as Spot Premium Drops

Join our free newsletter for daily crypto updates!