Researchers have discovered a botnet dubbed PgMiner that targets Postgres databases running on Linux servers to install a cryptocurrency miner. Palo Alto Networks Unit42 researchers believe that PGMiner can potentially be disruptive due to the popularity of the Postgres database. With additional effort, the malware could target all major operating systems, they warn. The bot performs brute-force attacks against Postgres servers exposed online, it exploits a disputed Postgres remote code execution (RCE) flaw to compromises database servers. The operators use a command and control (C2) server hosted on the Tor network.”]
Source: https://securityaffairs.co/wordpress/112235/malware/pgminer-botnet-postgresql.html