Massive PostgreSQL Exploit: Over 1,500 Servers Hit by Cryptocurrency Mining Campaign

TL;DR

An ongoing cyber campaign has compromised over 1,500 PostgreSQL servers, deploying cryptocurrency miners. This variant of the PG_MEM malware, first identified by Aqua Security in August 2024, exploits exposed PostgreSQL instances to gain unauthorized access. The campaign is attributed to a threat actor tracked by Wiz, highlighting the critical need for robust security measures to protect database systems.

Ongoing PostgreSQL Exploit: Over 1,500 Servers Targeted

Campaign Overview

Exposed PostgreSQL instances are under attack in a sustained campaign aimed at deploying cryptocurrency miners. Cloud security firm Wiz has identified this activity as a variant of an intrusion set initially flagged by Aqua Security in August 2024. This variant employs a malware strain known as PG_MEM, targeting vulnerable PostgreSQL servers to mine cryptocurrency illicitly.

Threat Details

The campaign is attributed to a threat actor tracked by Wiz. This actor exploits exposed PostgreSQL instances, gaining unauthorized access and deploying cryptocurrency mining software. The use of the PG_MEM malware strain allows the attacker to operate stealthily, making detection and mitigation challenging¹.

Impact and Implications

The compromise of over 1,500 PostgreSQL servers underscores the significant risk posed by unsecured database instances. This incident highlights the need for robust security measures, including:

• Regularly updating and patching database software.
• Implementing strong access controls.
• Continuously monitoring for suspicious activity.

Expert Insights

Cybersecurity experts emphasize the importance of proactive defense strategies. Organizations must prioritize securing their database systems to prevent such exploits. The ongoing nature of this campaign suggests that threat actors are continually refining their tactics, necessitating vigilant security practices.

Conclusion

The ongoing PostgreSQL exploit serves as a stark reminder of the evolving threat landscape. As cyber attacks become more sophisticated, organizations must stay ahead by implementing comprehensive security measures. Protecting database systems from unauthorized access is crucial in safeguarding against cryptocurrency mining campaigns and other cyber threats.

Additional Resources

For further insights, check:

• The Hacker News

References

1. (2025, April 1). “Over 1,500 PostgreSQL Servers Compromised in Fileless Cryptocurrency Mining Campaign”. The Hacker News. Retrieved 2025-04-01. ↩︎