PGMiner: New Cryptocurrency Mining Botnet Delivered via PostgreSQL
Summary: Unit 42 researchers uncovered PGMiner, a Linux-based cryptocurrency mining botnet that exploits the disputed PostgreSQL remote code execution issue CVE-2019-9193, delivered through the database's 'copy from program' feature introduced in version 9.3. The malware scans port 5432 across private subnets and random public ranges, brute-forces the default 'postgres' user against a built-in password list, then downloads mining payloads that connect to a Monero mining pool and communicate with C2 servers through SOCKS5 proxies and .onion addresses.
What's compelling: At the time of writing, none of the vendors on VirusTotal detected PGMiner, and its use of a disputed CVE kept it under the radar until Unit 42 found it. The exploit hinges on the pg_execute_server_program privilege, so any PostgreSQL server where untrusted users hold superuser rights and a weak 'postgres' password is a candidate.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2019-9193
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026