PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CPU_HU: Fileless cryptominer targeting exposed PostgreSQL with over 1.5K victims

wiz.io | blog | #cloud-security | #postgresql | #database-security | #threat-research | #cryptomining | #fileless-malware
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Threat Research details JINX-0126, which abuses weak PostgreSQL credentials to run fileless XMRig-C3 cryptominers while dodging hash-based detection; C3Pool data suggests over 1,500 victims.
Published
Collected

Related coverage

blog · wiz.io
Soco404: Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload
Wiz tracks Soco404, a cryptomining campaign abusing PostgreSQL misconfigurations: it hits Linux and Windows, masquerades as system processes, hiding payloads in fake 404 pages on Google Sites.
blog · wiz.io
Unpacking Diicot - Evolving Campaign Targeting Linux Environments
Wiz Threat Research details an evolved Diicot (Mexals) campaign targeting Linux—corrupted UPX headers that defeat unpacking, HTTP-based C2, and cloud-aware payloads that spread or mine crypto.
blog · wiz.io
SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining
Wiz Research documented SeleniumGreed, an active campaign exploiting exposed, unauthenticated Selenium Grid services to run reverse shells and install XMRig cryptominers via the WebDriver API.
blog · wiz.io
Key takeaways from the Wiz 2023 Kubernetes Security Report
Highlights from Wiz's 2023 Kubernetes Security Report, based on 200,000+ scanned cloud accounts: new clusters face malicious scans within 22 minutes, kubelet endpoints sit exposed, cryptomining rises.
incident · wiz.io
Defending against database ransomware attacks
Wiz examines 'malware-less' database ransomware: exposed MySQL, PostgreSQL and MongoDB servers with weak auth are looted, wiped and ransomed via native commands — no malware to detect.
blog · wiz.io
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense
Wiz's contribution to the 2026 Verizon DBIR: exploitation is now the top initial access vector (31% of breaches) and only 26% of known exploited vulnerabilities were remediated.
Back