Saturday, May 3, 2025
HomeCyber AttackPG_MEM - A Malware Hide in Postgres Processes to Steal Data

PG_MEM – A Malware Hide in Postgres Processes to Steal Data

Published on

SIEM as a Service

Follow Us on Google News

Cybersecurity researchers at Aqua Nautilus have uncovered a new malware named PG_MEM that targets PostgreSQL databases.

This sophisticated malware employs brute force attacks to gain access, hides within legitimate PostgreSQL processes, and ultimately steals data while mining cryptocurrency.

This article delves into the intricate workings of PG_MEM, its attack flow, and its implications for database security.

- Advertisement - Google News

Understanding PostgreSQL and Brute Force Attacks

PostgreSQL, commonly called Postgres, is a robust open-source relational database management system known for its flexibility and reliability.

However, its popularity also makes it a target for cybercriminals, as per a report by Aqua Nautilus. Brute force attacks on PostgreSQL involve repeatedly attempting to guess database credentials until access is gained, exploiting weak passwords.

Once inside, attackers can execute arbitrary shell commands using the COPY … FROM PROGRAM SQL command, enabling them to perform malicious activities such as data theft or deploying malware.

Screenshot from Wireshark, illustrating failed brute force attempt against Postgres
Screenshot from Wireshark, illustrating failed brute force attempt against Postgres

The Attack Flow of PG_MEM

Stage 1: Brute Force Attack

The initial stage of the PG_MEM attack involves a brute-force attempt to gain access to the PostgreSQL database.

This involves numerous login attempts until the attacker successfully guesses the username and password.

Once access is gained, the attacker can execute commands and manipulate the database environment. Failed Brute Force Attempt

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial

Stage 2: Gaining Persistence

After gaining access, the attacker creates a superuser role in the database, allowing them to maintain control and evade detection.

This involves executing SQL commands to manipulate user roles and privileges, ensuring the attacker retains access while restricting others. Creating a Superuser Backdoor

The threat actor’s command to create a new superuser
The threat actor’s command to create a new superuser

Stage 3: System Discovery and Payload Delivery

The attacker gathers system information and delivers malicious payloads by exploiting PostgreSQL’s features.

Two files, including the PG_Core malware, were downloaded from the attacker’s remote server and executed to mine cryptocurrency.

The malware is cleverly disguised and executed using encoded commands to avoid detection.

Delivery of PG_Core malware
Delivery of PG_Core malware

The Role of PG_MEM in Cryptocurrency Mining

PG_MEM acts as a dropper for a cryptocurrency miner known as XMRIG. Once deployed, it optimizes the mining operation by leveraging the system’s resources.

The attacker establishes persistence by creating cron jobs that ensure the continued execution of PG_MEM, thereby maintaining control over the compromised server. Cryptocurrency Mining Configuration

Mining Cryptocurrency data
Mining Cryptocurrency data

Exposed PostgreSQL Servers: A Growing Concern

The discovery of PG_MEM highlights the vulnerability of exposed PostgreSQL servers. A search on Shodan, a search engine for Internet-connected devices, revealed over 800,000 publicly accessible PostgreSQL databases.

This underscores the urgent need for robust security measures to protect against such attacks. Exposed PostgreSQL Servers on Shodan

The results in Sodan of searching for internet-facing Postgres servers

The PG_MEM attack aligns with several techniques outlined in the MITRE ATT&CK framework.

These include exploiting public-facing applications, command and scripting interpreter execution, account manipulation, and resource hijacking. Understanding these techniques can help develop effective defense strategies.

Detection and Remediation

Organizations must adopt a defense-in-depth approach to safeguard against PG_MEM and similar threats.

This includes implementing strong password policies, regular security audits, and using runtime detection and response tools like Aqua’s Runtime Protection.

Such tools can detect suspicious behavior in real-time, providing crucial insights into potential vulnerabilities.

The PG_MEM malware, combining data theft with cryptocurrency mining, represents a sophisticated threat to PostgreSQL databases.

As cyber threats continue to evolve, organizations must enhance their security measures to ensure that their databases remain protected against malicious activities.

By understanding the tactics employed by attackers and implementing robust defenses, businesses can safeguard their critical data and maintain operational integrity.

Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

New StealC V2 Upgrade Targets Microsoft Installer Packages and PowerShell Scripts

StealC, a notorious information stealer and malware downloader first sold in January 2023, has...

Subscription-Based Scams Targeting Users to Steal Credit Card Information

Cybersecurity researchers at Bitdefender have identified a significant uptick in subscription-based scams, characterized by...

RansomHub Taps SocGholish: WebDAV & SCF Exploits Fuel Credential Heists

SocGholish, a notorious loader malware, has evolved into a critical tool for cybercriminals, often...

Hackers Weaponize Go Modules to Deliver Disk‑Wiping Malware, Causing Massive Data Loss

Cybersecurity researchers uncovered a sophisticated supply chain attack targeting the Go programming language ecosystem...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

New StealC V2 Upgrade Targets Microsoft Installer Packages and PowerShell Scripts

StealC, a notorious information stealer and malware downloader first sold in January 2023, has...

Subscription-Based Scams Targeting Users to Steal Credit Card Information

Cybersecurity researchers at Bitdefender have identified a significant uptick in subscription-based scams, characterized by...

RansomHub Taps SocGholish: WebDAV & SCF Exploits Fuel Credential Heists

SocGholish, a notorious loader malware, has evolved into a critical tool for cybercriminals, often...