Thursday, November 14, 2024
HomeCyber AttackPG_MEM - A Malware Hide in Postgres Processes to Steal Data

PG_MEM – A Malware Hide in Postgres Processes to Steal Data

Published on

Malware protection

Cybersecurity researchers at Aqua Nautilus have uncovered a new malware named PG_MEM that targets PostgreSQL databases.

This sophisticated malware employs brute force attacks to gain access, hides within legitimate PostgreSQL processes, and ultimately steals data while mining cryptocurrency.

This article delves into the intricate workings of PG_MEM, its attack flow, and its implications for database security.

- Advertisement - SIEM as a Service

Understanding PostgreSQL and Brute Force Attacks

PostgreSQL, commonly called Postgres, is a robust open-source relational database management system known for its flexibility and reliability.

However, its popularity also makes it a target for cybercriminals, as per a report by Aqua Nautilus. Brute force attacks on PostgreSQL involve repeatedly attempting to guess database credentials until access is gained, exploiting weak passwords.

Once inside, attackers can execute arbitrary shell commands using the COPY … FROM PROGRAM SQL command, enabling them to perform malicious activities such as data theft or deploying malware.

Screenshot from Wireshark, illustrating failed brute force attempt against Postgres
Screenshot from Wireshark, illustrating failed brute force attempt against Postgres

The Attack Flow of PG_MEM

Stage 1: Brute Force Attack

The initial stage of the PG_MEM attack involves a brute-force attempt to gain access to the PostgreSQL database.

This involves numerous login attempts until the attacker successfully guesses the username and password.

Once access is gained, the attacker can execute commands and manipulate the database environment. Failed Brute Force Attempt

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial

Stage 2: Gaining Persistence

After gaining access, the attacker creates a superuser role in the database, allowing them to maintain control and evade detection.

This involves executing SQL commands to manipulate user roles and privileges, ensuring the attacker retains access while restricting others. Creating a Superuser Backdoor

The threat actor’s command to create a new superuser
The threat actor’s command to create a new superuser

Stage 3: System Discovery and Payload Delivery

The attacker gathers system information and delivers malicious payloads by exploiting PostgreSQL’s features.

Two files, including the PG_Core malware, were downloaded from the attacker’s remote server and executed to mine cryptocurrency.

The malware is cleverly disguised and executed using encoded commands to avoid detection.

Delivery of PG_Core malware
Delivery of PG_Core malware

The Role of PG_MEM in Cryptocurrency Mining

PG_MEM acts as a dropper for a cryptocurrency miner known as XMRIG. Once deployed, it optimizes the mining operation by leveraging the system’s resources.

The attacker establishes persistence by creating cron jobs that ensure the continued execution of PG_MEM, thereby maintaining control over the compromised server. Cryptocurrency Mining Configuration

Mining Cryptocurrency data
Mining Cryptocurrency data

Exposed PostgreSQL Servers: A Growing Concern

The discovery of PG_MEM highlights the vulnerability of exposed PostgreSQL servers. A search on Shodan, a search engine for Internet-connected devices, revealed over 800,000 publicly accessible PostgreSQL databases.

This underscores the urgent need for robust security measures to protect against such attacks. Exposed PostgreSQL Servers on Shodan

The results in Sodan of searching for internet-facing Postgres servers

The PG_MEM attack aligns with several techniques outlined in the MITRE ATT&CK framework.

These include exploiting public-facing applications, command and scripting interpreter execution, account manipulation, and resource hijacking. Understanding these techniques can help develop effective defense strategies.

Detection and Remediation

Organizations must adopt a defense-in-depth approach to safeguard against PG_MEM and similar threats.

This includes implementing strong password policies, regular security audits, and using runtime detection and response tools like Aqua’s Runtime Protection.

Such tools can detect suspicious behavior in real-time, providing crucial insights into potential vulnerabilities.

The PG_MEM malware, combining data theft with cryptocurrency mining, represents a sophisticated threat to PostgreSQL databases.

As cyber threats continue to evolve, organizations must enhance their security measures to ensure that their databases remain protected against malicious activities.

By understanding the tactics employed by attackers and implementing robust defenses, businesses can safeguard their critical data and maintain operational integrity.

Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Windows 0-Day Exploited in Wild with Single Right Click

A newly discovered zero-day vulnerability, CVE-2024-43451, has been actively exploited in the wild, targeting Windows...

Automating Identity and Access Management for Modern Enterprises

Keeping track of who has access and managing their permissions has gotten a lot...

Finding The Right E-Commerce Platform – Comparing Reselling Solutions

If you’re looking to make some extra cash or to start a business, you...

Fortinet Patches Critical Flaws That Affected Multiple Products

Fortinet, a leading cybersecurity provider, has issued patches for several critical vulnerabilities impacting multiple...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Windows 0-Day Exploited in Wild with Single Right Click

A newly discovered zero-day vulnerability, CVE-2024-43451, has been actively exploited in the wild, targeting Windows...

Fortinet Patches Critical Flaws That Affected Multiple Products

Fortinet, a leading cybersecurity provider, has issued patches for several critical vulnerabilities impacting multiple...

China-Nexus Actors Hijack Websites to Deliver Cobalt Strike malware

A Chinese state-sponsored threat group, identified as TAG-112, has been discovered hijacking Tibetan community...