- Scientists at Wiz Spot A New Cryptojacking Campaign
- It has targeted more than 1,500 misunderstood postgresql servers
- A variant of the infamous Xmrig miner was deployed to try to steal crypto
Hackers are targeted at misunderstood and publicly exposed postgresql servers with cryptocurrency miners, making them practically useless when they rapid the electricity bill for the victims, scientists have warned.
Wiz threat research experts said the new attack was actually a variant of an already observed, running campaign as the threat actors (as they call Jinx-0126) are targeted against Postgresql deposits configured with weak and guessing login credentials. Once they have found them and log in, they implement the XMRIG-C3 cryptics.
XMRIG is a hugely popular cryptomins as it mines Monero Cryptocurrency, which is generally much more difficult to track, compared to Bitcoin or other mineral currencies.
Mining Monero
A cryptocurrency mines use almost all of the device’s calculation effect, making it useless for virtually everything else. This also means increased electricity consumption, resulting in an inflated bill at the end of the month.
Cyber criminals, on the other hand, have Monero sent directly into their wallets that they can sell in the open market to US dollars or any other cryptocurrency. In many cases, the money is spent on other malicious campaigns.
Wiz says the campaign was first documented by researchers from Aqua Security, but it has since evolved.
The threat actors have reportedly implemented additional defense mechanisms and implementing the miner filled to avoid being discovered.
The researchers found that the threat actor assigned a unique mining to each victim, making it relatively easy to determine how many devices were likely to be compromised. Based on their analysis, the campaign probably affected more than 1,500 units.
“This suggests that incorrectly configured Postgresql deposits are very common, giving a low hanging fruit input for opportunistic threat actors to exploit,” they said.
“Furthermore, our data shows that almost 90% of the sky environments self-host Postgresql deposits, one-third of which has at least one case publicly exposed to the Internet.”
Via Hacker the news
