# CPU_HU: Fileless cryptominer targeting exposed PostgreSQL with over 1.5K victims

JINX-0126 brute-forces exposed PostgreSQL with weak creds, uses COPY FROM PROGRAM to deploy fileless XMRig-C3 miners, compromising 1,500+ hosts.

- Payout: Real-world hack
- Severity: high
- Program: PostgreSQL
- Credited: Wiz Research
- Disclosed: 2025-03-31
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/postgresql-cryptomining
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-postgresql-cryptomining
- Tags: domain:cloud domain:infra impact:integrity impact:mass-exploit kind:incident platform:threat-intel sev:high tech:linux technique:recon vuln:misconfiguration vuln:rce

**Target:** Publicly exposed PostgreSQL servers with weak/default credentials
**Root cause:** PostgreSQL instances exposed with weak/guessable credentials allow authenticated attackers to abuse COPY ... FROM PROGRAM to execute shell commands as the database OS user.
**Steps:**
1. Brute-force/spray PostgreSQL logins with default weak credentials
2. Authenticate and run discovery: `whoami`, `uname`, check for `pg_core`
3. Execute base64-decoded dropper via `COPY ... FROM PROGRAM`; kills rival miners (zsvc, kinsing, kdevtmpfsi) and downloads `pg_core` from `159.223.123.175:36287`
4. Download `postmaster` binary via bash `/dev/tcp` to `159.223.123.175:36287`
5. Append AES-encrypted config trailer (key `7C6643CC...DCD5`) to postmaster binary
6. postmaster reads last 1024 bytes, creates cronjob every minute, rewrites pg_hba.conf to trust internal ranges and reject others
7. Create superuser role `psql_sys` with password `759686ac19adbd08b94cf53f35afdd1e`; `ALTER USER admin NOSUPERUSER NOCREATEROLE`
8. postmaster drops `cpu_hu`, which downloads C3Pool xmrig-C3, writes config to /tmp, executes miner filelessly via memfd, then deletes itself
**How found:** Wiz Threat Research analyzed a honeypot sample, decoded base64 dropper and AES-encrypted config trailer, and correlated three C3Pool wallets (~550 workers each) to estimate 1,500+ victims.
**Exploitation:** Attacker scans internet for exposed PostgreSQL, sprays weak credentials, authenticates, then uses COPY FROM PROGRAM to run a shell dropper. Dropper kills competing miners, fetches pg_core and a masqueraded postmaster binary, appends per-victim encrypted config (wallet, worker id, creds, IP). postmaster persists via cron, locks out other admins via pg_hba.conf and role changes, then deploys cpu_hu which runs XMRig-C3 filelessly via memfd to mine Monero to attacker wallets on mine.c3pool.com:13333.
**Escalation:** Per-victim unique binary hashes and fileless memfd execution evade hash-reputation CWPP; pg_hba.conf rewrite and superuser role creation lock out defenders and preserve access.
**Insight:** Appended encrypted config trailers to packed Go binaries give per-victim unique hashes; hunt for binaries whose last 1024 bytes decode to JSON with wallet/worker fields, and check pg_hba.conf for injected trust rules.