Increase in Crypto-Mining Attacks on PostgreSQL Servers
According to a report by IT-Boltwise, a surge in cyberattacks targeting PostgreSQL servers has been observed. These attacks exploit misconfigured and publicly accessible servers to mine the cryptocurrency Monero. The attackers, identified as the group JINX-0126, take advantage of weak or easily guessable credentials to gain access to these servers. Once access is obtained, they deploy the XMRig-C3 cryptominer, which monopolizes the server's computational power, rendering it unusable for legitimate tasks.
The financial impact on affected companies is significant. The unauthorized mining activity leads to increased electricity costs, while the mined Monero coins are transferred directly to the attackers' digital wallets. Monero is particularly attractive to cybercriminals due to its high level of transaction anonymity, making it difficult to trace.
"The attacks are becoming more sophisticated, with hackers employing fileless techniques to evade detection," noted security researchers from Wiz.
It is estimated that over 1,500 devices have been compromised in this campaign. Alarmingly, nearly 90% of cloud environments host self-managed PostgreSQL instances, with one-third of these being publicly accessible. This highlights the urgent need for organizations to review and strengthen their server configurations to mitigate such risks.
| Key Findings | Details |
|---|---|
| Targeted Servers | PostgreSQL |
| Cryptocurrency Mined | Monero |
| Compromised Devices | Over 1,500 |
| Cloud Environments with Public Access | 33% |
Summary: The rise in crypto-mining attacks on PostgreSQL servers underscores the importance of robust security measures. Organizations must address misconfigurations and implement stronger access controls to prevent unauthorized exploitation of their resources.
Sources:
