Safety researchers have uncovered this 7 days a botnet procedure that targets PostgreSQL databases to install a cryptocurrency miner.

Codenamed by scientists as PgMiner, the botnet is just the newest in a long listing of modern cybercrime operations that target web-tech for monetary revenue.

According to researchers at Palo Alto Networks’ Device 42, the botnet operates by accomplishing brute-power attacks from web-available PostgreSQL databases.

The assaults observe a straightforward pattern.

The botnet randomly picks a public network range (e.g., and then iterates by means of all IP addresses component of that array, browsing for units that have the PostgreSQL port (port 5432) exposed on-line.

If PgMiner finds an active PostgreSQL technique, the botnet moves from the scanning period to its brute-force stage, in which it shuffles by a lengthy listing of passwords in an try to guess the credentials for “postgres,” the default PostgreSQL account.

If PostgreSQL databases proprietors have neglected to disable this consumer or have neglected to modify its passwords, the hackers accessibility the database and use the PostgreSQL COPY from PROGRAM feature to escalate their accessibility from the databases application to the underlying server and just take about the entire OS.

Once they have a extra strong maintain on the infected technique, the PgMiner crew deploys a coin-mining application and endeavor to mine as a lot Monero cryptocurrency ahead of they get detected.

In accordance to Unit 42, at the time of their report, the botnet only experienced the ability to deploy miners on Linux MIPS, ARM, and x64 platforms.

Other noteworthy features of the PgMiner botnet consist of the fact that its operators have been managing infected bots by means of a command and manage (C2) server hosted on the Tor network and that the botnet’s codebase seems to resemble the SystemdMiner botnet.


Image: Palo Alto Networks

PgMiner marks the second time a coin-miner operation targets PostgreSQL databases, with identical assaults observed in 2018, carried out by the StickyDB botnet.

Other database technologies that have also been qualified by crypto-mining botnets in the past incorporate MySQL, MSSQL, Redis, and OrientDB.