detection Archives

Tech Optimizer

April 3, 2025

1,500+ PostgreSQL Servers Compromised With Fileless Malware Attack

A cryptojacking campaign has targeted over 1,500 organizations by exploiting inadequately secured PostgreSQL database servers. The attackers, identified as JINX-0126, use advanced techniques including credential brute-forcing and fileless execution to deploy Monero (XMR)-mining malware. Approximately 30% of cloud-hosted PostgreSQL servers are affected due to weak or default credentials. The attackers execute commands using PostgreSQL’s COPY FROM PROGRAM function, bypassing standard detection mechanisms. They have been linked to three cryptocurrency wallets with around 550 active mining workers, generating a hashrate of 4.04 GH/s and approximately €10.40 per hour in XMR revenue. The attack begins with credential spraying against default accounts, followed by an SQL injection to fetch the payload. The malware operates in memory, modifies PostgreSQL’s configuration to maintain persistence, and creates cron jobs for reactivation. The campaign reveals significant security gaps in cloud environments, with recommendations for improved access controls and monitoring.

Tech Optimizer

April 2, 2025

Over 1,500 PostgreSQL Servers Hit by Fileless Malware Attack

A malware campaign has compromised over 1,500 PostgreSQL servers using fileless techniques to deploy cryptomining payloads. The attack, linked to the threat actor group JINX-0126, exploits publicly exposed PostgreSQL instances with weak or default credentials. The attackers utilize advanced evasion tactics, including unique hashes for binaries and fileless execution of the miner payload, making detection difficult. They exploit PostgreSQL’s COPY ... FROM PROGRAM function to execute malicious payloads and perform system discovery commands. The malware includes a binary named “postmaster,” which mimics legitimate processes, and a secondary binary named “cpu_hu” for cryptomining operations. Nearly 90% of cloud environments host PostgreSQL databases, with about one-third being publicly exposed, providing easy entry points for attackers. Each wallet associated with the campaign had around 550 active mining workers, indicating the extensive scale of the attack. Organizations are advised to implement strong security configurations to protect their PostgreSQL instances.

Tech Optimizer

April 2, 2025

Thousands of PostgreSQL servers are being hijacked to mine crypto

Researchers at Wiz have identified a cryptojacking campaign by a group called JINX-0126, targeting over 1,500 misconfigured PostgreSQL servers by exploiting weak login credentials. The attackers deploy the XMRig-C3 miner to mine Monero, consuming nearly all computing resources and increasing electricity usage for victims. Each compromised device is assigned a unique mining worker for tracking. The campaign has evolved to include defensive measures and fileless deployment to evade detection. Nearly 90% of cloud environments host PostgreSQL instances, with about one-third publicly accessible, highlighting security vulnerabilities.

Tech Optimizer

April 2, 2025

Improve PostgreSQL performance using the pgstattuple extension

PostgreSQL is an open-source relational database management system known for its extensibility, which allows developers to enhance its capabilities through various extensions and plugins. The pgstattuple extension provides detailed statistics at the tuple level from PostgreSQL tables and indexes, revealing key metrics such as the number of live tuples, dead tuples, average length of live tuples, total free space, and percentages of free space and dead tuples. These metrics help database administrators identify potential health and performance issues, such as excessive table bloat or index fragmentation. Both Amazon Aurora and Amazon RDS support the pgstattuple extension, which can be activated using the command CREATE EXTENSION pgstattuple;. Functions like pgstattuple(relation) and pgstatindex(index) can be used to analyze physical storage and index statistics. Bloat occurs when unused space is left behind after UPDATE and DELETE operations, and the autovacuum process in PostgreSQL automates the cleanup of dead tuples. However, if autovacuum fails, manual intervention may be necessary. Regular monitoring of bloat is essential for maintaining performance, and metrics from pgstattuple can help optimize autovacuum settings. The pg_cron extension can automate VACUUM operations to manage bloat proactively. Index bloat can also be detected using pgstatindex, and significantly bloated indexes can be rebuilt using REINDEX or pg_repack. Best practices for using pgstattuple include estimating bloat with check_postgres, analyzing physical storage, monitoring dead_tuple_percent, and avoiding interference on highly active tables.

Tech Optimizer

April 2, 2025

Ongoing cryptomining campaign hits over 1.5K PostgreSQL servers

Over 1,500 PostgreSQL instances exposed to the internet have been targeted by a cryptocurrency mining malware campaign called JINX-0126. Attackers exploit weak credentials to access PostgreSQL servers and use the "COPY ... FROM PROGRAM SQL" command for arbitrary command execution. They deploy a shell script to terminate existing cryptominers and deliver the pg_core binary. A Golang binary, disguised as the PostgreSQL multi-user database server, is then downloaded to establish persistence and escalate privileges, leading to the execution of the latest XMRig cryptominer variant. JINX-0126 employs advanced tactics, including unique hashes for binaries and fileless miner payload execution, to evade detection by cloud workload protection platforms.

AppWizard

April 2, 2025

Google made a dashcam app for cars with Android Automotive, but you can’t download it

Google has launched a dashcam application for Android Automotive that allows vehicles with built-in cameras to record their surroundings. This open-source app can be integrated by car manufacturers, addressing the gap where many vehicles lack a native dashcam feature. The app is designed to work with existing camera hardware and requires system-level permissions for integration into the vehicle's operating system. Recordings are stored in the vehicle's internal storage, but Google recommends saving them on external removable storage to reduce wear on internal components. Manufacturers can customize various parameters of the app, including storage allocation and user interface.

AppWizard

April 2, 2025

Google may finally stop forcing you to manually ask to ID songs (APK teardown)

Google is refining its music identification capabilities on Android devices, with potential upgrades revealed through an APK teardown. Currently, users can identify songs using features like Circle to Search and Now Playing, but the process often requires manual prompts. The latest version of the Google app (build 16.12.39.sa.arm64) shows signs of automatic music detection, changing the interface to "Searching song..." upon recognition, although users still need to tap a button to view results. The absence of the typical pulsing-sphere visual element indicates that this feature is still in development.

AppWizard

April 1, 2025

Beware new Google ‘yellow warning’ that saves you from costly nightmare

Google has introduced a yellow warning banner in the Google Play Store to alert Android users about apps that are frequently uninstalled. This banner indicates that an app may not be meeting user expectations and could be due to poor functionality, excessive advertisements, or inflated costs. Additionally, Google has implemented two other notifications: one indicating lower user engagement with an app and another showing fewer users compared to other apps. These features aim to help users make more informed app choices and avoid potentially harmful applications. Google Play Protect is also available to scan downloaded apps for security, including those from outside the Play Store. Users can enable settings to improve harmful app detection, enhancing overall safety in the app ecosystem.

AppWizard

April 1, 2025

Google’s Play Store Warning—Do Not Update This Setting

A sophisticated trojan named TsarBot is targeting over 750 legitimate banking and shopping applications on Android devices. It overlays a counterfeit login screen on real apps to capture user credentials. TsarBot is believed to have Russian origins and can remotely control the device's screen, simulating user interactions and capturing device lock credentials through a deceptive lock screen. The trojan is typically installed from phishing websites, where a dropper application delivers the TsarBot APK file. Once installed, it disguises itself as the Google Play Services app and urges users to enable Accessibility services. Users are advised to avoid installing apps from outside the Google Play Store, ensure Play Protect is enabled, and only enable Accessibility Services when necessary to mitigate risks.

Tech Optimizer

March 31, 2025

Watch Out for This Info-Stealing Malware on Windows

A new malware strain called CoffeeLoader has been identified, posing a significant risk to gamers by masquerading as a legitimate ASUS utility, specifically the Armoury Crate software. Once it infiltrates a system, it deploys the Rhadamanthys infostealer, which can extract sensitive information such as credentials from web browsers, email clients, cryptocurrency wallets, and password managers. CoffeeLoader evades detection by most security tools by operating on the GPU instead of the CPU and using advanced techniques like call stack spoofing, sleep obfuscation, and exploiting Windows fibers. To protect against CoffeeLoader, users should exercise caution when downloading software, navigate directly to official websites, avoid suspicious links, and adhere to basic cybersecurity practices. If infection is suspected, users should disconnect from the internet, reboot in safe mode, delete temporary files, and check Task Manager for unusual activity. Employing a reliable malware scanner can help identify and eliminate infections.