[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flKOHCzpFnfdLtIaJrbMKTYOc05eQ55UZ466DMM5acxE":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":10,"target_industries":11,"target_countries":12,"incident_types":13,"references":14,"techniques":17,"technique_count":18,"created_at":19,"seoMetadata":20,"schemaOrg":24},"JINX-0126","jinx-0126",[],"Wiz Threat Research identified a new variant of an ongoing malicious campaign targeting misconfigured and publicly exposed PostgreSQL servers. In the observed attack, the threat actor (tracked by Wiz as JINX-0126) abuses exposed PostgreSQL instances, configured with weak and guessable login credentials, to gain access and to deploy XMRig-C3 cryptominers. This campaign was first documented by Aqua Security, but the threat actor has since evolved, implementing defense evasion techniques such as deploying binaries with a unique hash per target and executing the miner payload filelessly—likely to evade detection by CWPP solutions that rely solely on file hash reputation.",null,[],[],[],[15,16],"https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fpostgresql-cryptomining","https:\u002F\u002Fwww.aquasec.com\u002Fblog\u002Fpg_mem-a-malware-hidden-in-the-postgres-processes\u002F",[],0,"2025-04-19T01:15:05.852388+00:00",{"title":21,"metaDescription":22,"keywords":23},"JINX-0126 Threat Actor Profile | EdgeProtect","Wiz Threat Research identified a new variant of an ongoing malicious campaign targeting misconfigured and publicly exposed PostgreSQL servers. In the ...","JINX-0126, threat actor, APT, cyber threat, threat intelligence",{"@context":25,"@type":26,"name":6,"alternateName":27,"description":9,"url":28,"mainEntityOfPage":29},"https:\u002F\u002Fschema.org","Organization",[],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Fjinx-0126",{"@type":30,"@id":28},"WebPage"]