Thousands of PostgreSQL servers are being hijacked to mine crypto

• Researchers at Wiz spot a new cryptojacking campaign
• It has targeted more than 1,500 misconfigured PostgreSQL servers
• A variant of the infamous XMRig miner was deployed to try and steal crypto

Hackers are targeting misconfigured and publicly exposed PostgreSQL servers with cryptocurrency miners, rendering them practically unusable as they rake up the electricity bill for the victims, researchers have warned.

Wiz Threat Research experts said the new attack was actually a variant of an already observed, ongoing campaign, as the threat actors (which they call JINX-0126) are targeting PostgreSQL instances configured with weak and guessable login credentials. Once they find them and log in, they deploy the XMRig-C3 cryptominer.