SYMBOLCOMMON_NAMEaka. SYNONYMS

JINX-0126  (Back to overview)


Wiz Threat Research identified a new variant of an ongoing malicious campaign targeting misconfigured and publicly exposed PostgreSQL servers. In the observed attack, the threat actor (tracked by Wiz as JINX-0126) abuses exposed PostgreSQL instances, configured with weak and guessable login credentials, to gain access and to deploy XMRig-C3 cryptominers. This campaign was first documented by Aqua Security, but the threat actor has since evolved, implementing defense evasion techniques such as deploying binaries with a unique hash per target and executing the miner payload filelessly—likely to evade detection by CWPP solutions that rely solely on file hash reputation.


Associated Families

There are currently no families associated with this actor.


References
2025-03-31Wiz.ioAvigayil Mechtinger, Gili Tikochinski, Yaara Shriki
CPU_HU: Fileless cryptominer targeting exposed PostgreSQL with over 1.5K victims
JINX-0126
2024-08-19AquasecAssaf Morag
PG_MEM: A Malware Hidden in the Postgres Processes
PG_MEM XMRIG JINX-0126

Credits: MISP Project