PG_MEM – A Malware Hide in Postgres Processes to Steal Data

Cybersecurity researchers at Aqua Nautilus have uncovered a new malware named PG_MEM that targets PostgreSQL databases.

This sophisticated malware employs brute force attacks to gain access, hides within legitimate PostgreSQL processes, and ultimately steals data while mining cryptocurrency.

This article delves into the intricate workings of PG_MEM, its attack flow, and its implications for database security.

- Advertisement -

Understanding PostgreSQL and Brute Force Attacks

PostgreSQL, commonly called Postgres, is a robust open-source relational database management system known for its flexibility and reliability.

However, its popularity also makes it a target for cybercriminals, as per a report by Aqua Nautilus. Brute force attacks on PostgreSQL involve repeatedly attempting to guess database credentials until access is gained, exploiting weak passwords.

Once inside, attackers can execute arbitrary shell commands using the COPY … FROM PROGRAM SQL command, enabling them to perform malicious activities such as data theft or deploying malware.

The Attack Flow of PG_MEM

Stage 1: Brute Force Attack

The initial stage of the PG_MEM attack involves a brute-force attempt to gain access to the PostgreSQL database.

This involves numerous login attempts until the attacker successfully guesses the username and password.

Once access is gained, the attacker can execute commands and manipulate the database environment. Failed Brute Force Attempt

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial

Stage 2: Gaining Persistence

After gaining access, the attacker creates a superuser role in the database, allowing them to maintain control and evade detection.

This involves executing SQL commands to manipulate user roles and privileges, ensuring the attacker retains access while restricting others. Creating a Superuser Backdoor

Stage 3: System Discovery and Payload Delivery

The attacker gathers system information and delivers malicious payloads by exploiting PostgreSQL’s features.

Two files, including the PG_Core malware, were downloaded from the attacker’s remote server and executed to mine cryptocurrency.

The malware is cleverly disguised and executed using encoded commands to avoid detection.

The Role of PG_MEM in Cryptocurrency Mining

PG_MEM acts as a dropper for a cryptocurrency miner known as XMRIG. Once deployed, it optimizes the mining operation by leveraging the system’s resources.

The attacker establishes persistence by creating cron jobs that ensure the continued execution of PG_MEM, thereby maintaining control over the compromised server. Cryptocurrency Mining Configuration

Exposed PostgreSQL Servers: A Growing Concern

The discovery of PG_MEM highlights the vulnerability of exposed PostgreSQL servers. A search on Shodan, a search engine for Internet-connected devices, revealed over 800,000 publicly accessible PostgreSQL databases.

This underscores the urgent need for robust security measures to protect against such attacks. Exposed PostgreSQL Servers on Shodan

The PG_MEM attack aligns with several techniques outlined in the MITRE ATT&CK framework.

These include exploiting public-facing applications, command and scripting interpreter execution, account manipulation, and resource hijacking. Understanding these techniques can help develop effective defense strategies.

Detection and Remediation

Organizations must adopt a defense-in-depth approach to safeguard against PG_MEM and similar threats.

This includes implementing strong password policies, regular security audits, and using runtime detection and response tools like Aqua’s Runtime Protection.

Such tools can detect suspicious behavior in real-time, providing crucial insights into potential vulnerabilities.

The PG_MEM malware, combining data theft with cryptocurrency mining, represents a sophisticated threat to PostgreSQL databases.

As cyber threats continue to evolve, organizations must enhance their security measures to ensure that their databases remain protected against malicious activities.

By understanding the tactics employed by attackers and implementing robust defenses, businesses can safeguard their critical data and maintain operational integrity.

Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial