OVER 1,500 POSTGRESQL SERVERS COMPROMISED IN FILELESS CRYPTOCURRENCY MINING CAMPAIGN

Summary from the TLDR InfoSec newsletter

Exposed PostgreSQL instances are the target of an ongoing campaign designed to gain unauthorized access and deploy cryptocurrency miners. It utilizes the COPY... FROM PROGRAM SQL command to execute arbitrary shell commands on the host and also deploys an obfuscated Golang binary codenamed postmaster that mimics the legitimate PostgreSQL multi-user database server.