A picture got my PostgreSQL database to start mining Monero
The short story of this is:- Gain access to the database itself- And the Postgres database should be vulnerable to various remote code execution- Once they're able to execute code remotely, they then download an image which has binary data tacked onto it- They then parse out the executable part of the image using dd- Then they're able to execute and mine awayWhile an interesting read the shortest takeaway is:1. Don't leave your Postgres open to the public internet and2. Ensure to upgrade when security releases come out.If you're unsure if the version your on has security patches available or other reasons to upgrade consider checking out https://why-upgrade.depesz.com/Edit: Looks like the user that gained access had ability to execute pl/c. Which has to run as superuser. You won't find things like pl/c, pl/python generally supported on most Postgres services like Heroku, RDS, Citus because of just this reason. So in this case database access with pl/c was enabled, suspect could have been done equally via other vectors (once database access was achieved).