Security researchers at Wiz have identified an ongoing campaign targeting vulnerable PostgreSQL instances to deploy cryptocurrency mining malware. The operation, attributed to a threat actor known as JINX-0126, represents an evolution of the PG_MEM malware campaign first discovered by Aqua Security in August 2024.

## Sophisticated Evasion Techniques

The attackers have enhanced their methods to avoid detection, implementing several advanced evasion tactics:
– Deploying binaries with unique hash signatures for each target
– Executing mining payloads filelessly to bypass cloud workload protection platforms
– Mimicking legitimate PostgreSQL processes

## Widespread Impact

The campaign has reportedly compromised over 1,500 machines globally, targeting PostgreSQL instances with weak or predictable credentials. This widespread vulnerability highlights how exposed database services continue to be attractive targets for opportunistic threat actors.

## Attack Methodology

The attackers exploit vulnerable databases through a distinctive technique:
1. Abuse the “COPY … FROM PROGRAM” SQL command to execute arbitrary shell commands
2. Conduct reconnaissance on compromised systems
3. Deploy Base64-encoded shell scripts that eliminate competing miners
4. Install malware components including “PG_CORE” and a Golang binary called “postmaster”
5. Establish persistence via cron jobs and create privileged database roles
6. Deploy the XMRig cryptocurrency miner using Linux fileless techniques

Researchers noted that the threat actor assigns unique mining workers to each victim, with analysis revealing three different cryptocurrency wallets linked to the operation, each controlling approximately 550 compromised machines.

## Cryptocurrency Mining Operations

The campaign demonstrates how exposed database services remain lucrative targets for cryptocurrency mining operations, with attackers continuously evolving their techniques to maximize profits while evading detection.