CPU_HU Campaign Uses Exposed PostgreSQL Servers to Deploy Fileless Cryptominers
Summary
Wiz describes JINX-0126’s use of weakly credentialed exposed PostgreSQL servers to deploy fileless XMRig-C3 miners. Pool statistics suggest the campaign may have affected over 1,500 machines.
Key points
- Wiz says the actor accessed publicly exposed PostgreSQL instances using weak or guessable credentials and abused PostgreSQL’s COPY ... FROM PROGRAM function to run commands.
- The campaign deploys obfuscated, uniquely configured binaries; the miner runs filelessly and deletes itself, making file hashes vary between victims.
- The malware creates a privileged PostgreSQL role and a cron job for persistence, and modifies PostgreSQL access controls.
- Wiz linked three wallets to the campaign and estimates over 1,500 affected machines based on roughly 550 workers per wallet in C3Pool statistics.
- Wiz reports finding the activity in customer cloud environments and its honeypot; it recommends identifying exposed PostgreSQL services with weak credentials and checking for related activity.
Article Details
- Attack Vectors
- The actor targets publicly exposed, misconfigured PostgreSQL servers using weak or guessable credentials.
- After authentication, the actor abuses PostgreSQL's COPY ... FROM PROGRAM functionality to execute commands and deliver payloads.
- A shell dropper downloads binaries from 159.223.123.175:36287; the miner then downloads XMRig-C3 from the C3Pool GitHub repository.
- Defensive Notes
- Avoid exposing PostgreSQL publicly and replace weak or default credentials with strong credentials.
- Monitor PostgreSQL activity for unexpected COPY ... FROM PROGRAM use, newly created privileged roles, changes to pg_hba.conf, and cron jobs that run every minute.
- Detect suspicious postmaster or cpu_hu execution, fileless miner activity, and unexpected outbound connections to 159.223.123.175:36287 or mine.c3pool.com:13333.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | mine[.]c3pool[.]com | Mining pool endpoint used by the cryptominer on port 13333. |
| IPV4 | 159[.]223[.]123[.]175 | File-hosting server used to deliver the campaign's pg_core and postmaster payloads on port 36287. |
| SHA1 | 0b907eee9a85d39f8f0d7c503cc1f84a71c4de10 | SHA1 hash identified for the XMRig-C3 miner. |
| SHA1 | 7ccfcacfa2a729494dece843e9c4d357f2eec780 | SHA1 hash of the postmaster payload before its configuration trailer was added. |
| SHA1 | 85198288e2ff1dad718cd84876a0b0d3173a641e | SHA1 hash identified for the pg_core dropper. |
MITRE ATT&CK
T1027.001 · Binary PaddingThe actor appends an encrypted configuration to the postmaster binary.T1027.002 · Software PackingThe postmaster and cpu_hu Go binaries are packed with modified UPX.T1036.005 · Match Legitimate Resource Name or LocationThe actor names a malicious binary postmaster to resemble the legitimate PostgreSQL process.T1053.003 · CronThe postmaster binary is configured to run through a cron job every minute.T1059.004 · Unix ShellThe actor uses Unix shell commands and scripts to download, execute, and configure payloads.T1070.004 · File DeletionThe actor deletes pg_core and cpu_hu after execution.T1071.001 · Web ProtocolsThe dropper retrieves payloads over HTTP from 159.223.123.175:36287.T1082 · System Information DiscoveryAfter login, the actor runs whoami and uname and checks for pg_core.T1098 · Account ManipulationThe actor alters the default admin user to remove superuser and role-creation privileges.T1105 · Ingress Tool TransferThe actor downloads pg_core and postmaster payloads from 159.223.123.175:36287.T1110.003 · Password SprayingThe actor scans for PostgreSQL services and attempts weak or guessable credentials.T1136 · Create AccountThe actor creates a privileged PostgreSQL role for continued access.T1190 · Exploit Public-Facing ApplicationThe actor targets publicly exposed PostgreSQL instances and gains access through weak credentials and service abuse.T1496 · Resource HijackingThe actor deploys XMRig-C3 to mine cryptocurrency using compromised machines.T1564.001 · Hidden Files and DirectoriesThe miner configuration is written to a file under /tmp.T1620 · Reflective Code Loadingcpu_hu invokes the miner filelessly via a memfd file descriptor.
Threat Actors
Malware
cpu_hupostmaster writes the cpu_hu binary to disk. Similar to postmaster, cpu_hu is an obfuscated Golang binary packed with modified UPX. The base64 decoded miner configuration information is embedded at the end of the cpu_hupg_corethe threat actor conducts basic discovery with commands such as whoami and uname [T1082] and checks if pg_core exists on the workload. Next the threat actor runs the first dropper script [T1071.001] [T1105],postmasterThe attacker downloads a binary named postmaster, as an attempt to mimic the legitimate postmaster process, which is the PostgreSQL multiuser database server [T1036.005]. XMRig-C3PostgreSQL instances, configured with weak and guessable login credentials, to gain access and to deploy XMRig-C3 cryptominers. This campaign was first documented by Aqua Security, but the threat actor has since