Security company Imperva set up a range of database honeypots to learn about common database attacks and techniques employed by attackers. Hackers used a photo of Scarlett Johansson to conceal their cryptominer so that it could be hidden in plain site, on a publicly accessible image hosting service. With that the hackers had to find and exploit a computer on which to run it. They used a database function that mapped to the do-anything function in the binary payload to run commands on the host computer itself. The newly minted database function was used to download Ms Johanssons picture from the file hosting service, using wget and the end of the picture sliced off into its own file.”]