Researchers at Wiz have identified a new cryptojacking campaign that has successfully targeted over 1,500 misconfigured PostgreSQL servers. This campaign, attributed to a group referred to as JINX-0126, exploits weak and easily guessable login credentials to gain unauthorized access to these databases.
Upon infiltrating the servers, the attackers deploy a variant of the notorious XMRig miner, specifically the XMRig-C3. This particular cryptominer is favored for its ability to mine Monero, a cryptocurrency known for its enhanced privacy features, making it significantly harder to trace compared to Bitcoin and other currencies.
Mining Monero
The deployment of a cryptocurrency miner consumes nearly all available computing resources on the infected device, rendering it nearly unusable for legitimate tasks. This excessive resource consumption leads to a notable increase in electricity usage, ultimately resulting in inflated utility bills for the victims. Meanwhile, cybercriminals benefit by receiving Monero directly into their wallets, which they can subsequently convert into US dollars or other cryptocurrencies. Often, these funds are reinvested into further malicious activities.
Wiz’s analysis indicates that this campaign has evolved since its initial documentation by Aqua Security researchers. The threat actors have reportedly implemented additional defensive measures and are now deploying the miner in a fileless manner, enhancing their ability to evade detection.
Interestingly, the researchers noted that each victim is assigned a unique mining worker, allowing for straightforward tracking of compromised devices. Their findings suggest that the campaign has likely affected more than 1,500 devices, highlighting a concerning trend: misconfigured PostgreSQL instances are alarmingly prevalent, presenting an easy target for opportunistic attackers.
Moreover, data from Wiz indicates that nearly 90% of cloud environments host PostgreSQL instances, with approximately one-third of these instances being publicly accessible on the internet. This situation underscores the urgent need for organizations to bolster their security measures and ensure proper configuration of their database systems.
