JINX-0126

Wiz Threat Research identified a new variant of an ongoing malicious campaign targeting misconfigured and publicly exposed PostgreSQL servers. In the observed attack, the threat actor (tracked by Wiz as JINX-0126) abuses exposed PostgreSQL instances, configured with weak and guessable login credentials, to gain access and to deploy XMRig-C3 cryptominers. This campaign was first documented by Aqua Security, but the threat actor has since evolved, implementing defense evasion techniques such as deploying binaries with a unique hash per target and executing the miner payload filelessly—likely to evade detection by CWPP solutions that rely solely on file hash reputation.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.wiz.io/blog/postgresql-cryptomining
• https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/

Mənbə: MISP Galaxy, Malpedia.