Pg_mem: A Malware Hidden in the Postgres Processes

Aqua Nautilus researchers have identified a new malware named PG_MEM that targets PostgreSQL databases. This malware employs brute force attacks to gain unauthorized access, exploiting weak passwords. Once inside, it utilizes the COPY ... FROM PROGRAM SQL command to execute arbitrary shell commands, allowing the attacker to perform malicious activities such as data theft and cryptocurrency mining. The attack begins with repeated login attempts until the correct credentials are guessed. Following access, the attacker creates a superuser role, drops files to maintain persistence, and deploys cryptocurrency miners. The malware also includes mechanisms to eliminate competition by terminating other malicious processes. Researchers found over 800,000 exposed PostgreSQL databases online, underscoring the urgency for enhanced security measures against such attacks. The attack techniques align with the MITRE ATT&CK framework, highlighting various stages including initial access, execution, persistence, privilege escalation, and defense evasion. The findings emphasize the need for robust security practices to protect against brute force attacks and unauthorized access to database servers.

- PG_MEM malware targets PostgreSQL databases through brute force attacks.

- The malware executes arbitrary commands and deploys cryptocurrency miners.

- Over 800,000 exposed PostgreSQL databases were identified, indicating widespread vulnerability.

- The attack techniques used align with the MITRE ATT&CK framework.

- Enhanced security measures are critical to protect against such threats.