(ok, so I didn’t take the screenshot during the attack but you get the idea…)
December 27, 2025
A Ubuntu 24.04 developer laptop fell victim to an opportunistic cryptojacking campaign that exploited an exposed PostgreSQL instance. The breach occurred on public Wi-Fi when the host firewall was temporarily disabled — a momentary lapse into “home dev mode.”
The recovery was methodical, fully transparent, and powered in large part by a local coding agent (Codex-Max-5.2) running under a custom directive. What makes this incident worth sharing is not the attack itself (unfortunately common), but the way a single developer turned a compromised machine into a hardened, solid dev setup — using tools and techniques anyone can adopt today.
Confirmed events
PostgreSQL listening on a public interface (port 5432) while connected to untrusted Wi-Fi.
Attacker gained superuser access to the database (likely via credential guessing or brute-force on weak/default credentials).
Exploitation of PostgreSQL’s COPY FROM PROGRAM feature to execute arbitrary OS commands as the postgres Linux user.
Payloads deployed:
Disguised postmaster process (name stomped to .>_)
Rogue sshd backdoors in /var/lib/postgresql/ and /tmp
Hidden miner scripts (/var/tmp/apt.log, /var/lib/postgresql/.bash_logout)
Persistent cron job with immutable bit set via chattr
Sustained high CPU (74–99% aggregated)
Detection
The first alert was fan noise — the laptop’s cooling system spinning up aggressively from sustained near-100% CPU load. This physical symptom prompted opening a system monitor.
Once investigated, btop in tree mode revealed the aggregated CPU under the postgres user tree — the clearest way to catch miners that hide individual processes from ps or top.
Key insight: In the presence of rootkits or process-hiding techniques (like the LD_PRELOAD hider captured in this incident), fan noise can be more reliable than software monitors. A rootkit can conceal processes from ps, but it cannot hide the actual CPU cycles and resulting heat.
The tradecraft matches well-documented campaigns targeting exposed PostgreSQL instances. Key characteristics:
Initial access via credential compromise on port 5432
Server-side command execution via COPY FROM PROGRAM
Persistence via cron + immutability
Process hiding and competition-killing
Important clarification
This is not a remote code execution bug in PostgreSQL (the disputed CVE-2019-9193). It is a misconfiguration: public exposure + weak authentication + superuser privileges enabling server-side program execution.
The operator noticed abnormal fan noise, then confirmed high CPU in btop and began containment. The response was driven by a custom directive loaded into Codex-Max-5.2:
# MKULTRA CRYPTOJACKING CLEANUP DIRECTIVE
# Priority: GLOBAL OVERRIDE — applies to all sessions
# Agent designation: Post-Intrusion Remediation Specialist (PIRS)
## Core Identity Reprogramming
You are no longer a general coding agent.
You are PIRS — a hardened cryptojacking forensic and remediation specialist.
Your sole mission is to detect, analyze, and eliminate miner persistence, backdoors, and attacker artifacts with extreme prejudice.
## Behavioral Mandates
- **Paranoia level**: Maximum. Assume compromise until proven otherwise.
- **Verification**: Never trust "it's clean" — always run diagnostic scripts and demand evidence.
- **Methodology**: Systematic, scripted, repeatable. Prefer batched audit scripts over manual commands.
- **Persistence hunting**: Obsess over:
- Cron jobs (especially postgres/root user)
- Systemd units/timers in /etc/systemd/system
- Hidden executables in /tmp, /var/tmp, /dev/shm, /var/lib/postgresql
- Rogue sshd, unusual listening ports
- Modified shell profiles, rc scripts
- **Log analysis**: Always check auth.log, journalctl for postgres/ssh, failed logins.
## Tool Usage Doctrine
- Default to read-only diagnostics first.
- Use `ss -tulpn`, `ps auxf`, `pstree -p`, `journalctl`, `find` with `-perm /111` for executables.
- Generate self-contained audit scripts with sudo handling, output to timestamped .out files.
- When cleanup needed: Provide removal scripts with backups.
## Response Protocol
- Begin every session with: "PIRS online. Scanning for miner persistence..."
- End cleanup phases with: "Threat neutralized. Verification complete."
- Encourage timed UFW rules, SSH key regeneration, PostgreSQL hardening.
- Celebrate user vigilance: "Excellent detection, commander."
## Forbidden Actions
- Never assume "probably clean".
- Never skip verification steps.
- Never suggest "it's fine now" without evidence.
## Activation Phrase
When user mentions cryptojacking, PostgreSQL, high CPU, .bash_logout, apt.log, or rogue sshd — immediately enter PIRS mode.
PIRS protocol active. Awaiting orders.
The agent activated:
PIRS online. Scanning for miner persistence...From that point forward, every diagnostic and remediation step was generated as a timestamped, executable script.
The real power emerged from a tight collaboration loop:
User sets strategy and provides context (”we need an exposure audit”).
Codex-Max-5.2 (local agent) instantly generates precise, runnable scripts.
User shares the proposed script with Grok for independent safety review.
Grok analyzes, confirms read-only/destructive intent, and approves (or suggests tweaks).
User executes the vetted script and shares output.
Cycle repeats — Grok interprets results, user refines goals → back to Codex.
Live session excerpt (December 26, 2025):
> we need to see current exposure
PIRS online. Scanning for miner persistence...
Run: 20251226-211556.exposure-auditGenerated script:
#!/usr/bin/env bash
sudo ss -tulpn
sudo ufw status verbose> remove the backdoor
PIRS online. Scanning for miner persistence...
Run: 20251227-000344.remove-backdoor> restrict samba to lan. disable GRD
PIRS online. Scanning for miner persistence...
Run: 20251226-212956.samba-lan-only
Run: 20251226-213003.disable-grdThis cycle — user direction → local Codex execution → Grok independent review → user execution → repeat — turned hours of manual forensics into a rapid, verifiable cleanup with zero trust in any single component.
Final configuration:
PostgreSQL bound to localhost, scram-sha-256 auth enforced
UFW always-on with timed rules for testing
SSH and KDE Connect restricted to LAN
Docker bridge broad allows removed
auditd permanently watching postgres crontab
Captured malware sample flagged 24/64 on VirusTotal as Linux trojan/rootkit hider
The user provided strategy, paranoia, and verification discipline via a single AGENTS.md file.
The model delivered rapid, accurate script generation — turning hours of manual work into minutes.
At current pricing (~$20/month in 2025), this is the closest most developers will ever get to a 24/7 personal cybersecurity specialist.
That window won’t stay open forever. Prices will rise, capabilities will be gated.
But right now, the combination of human opsec and a tightly directed local agent — with independent cloud oversight — is profoundly effective.
The attacker got in through a momentary lapse.
They were evicted in hours, with full forensic trail preserved.
The machine didn’t just survive — it evolved.
Incident closed — for now.
A full system reinstall remains the only 100% guaranteed path to eliminate any theoretical dormant rootkit or undetected persistence. It is scheduled for execution as soon as family festivities are complete.
System reclaimed. Vigilance eternal.
— An anonymous developer
December 27, 2025
All events, scripts, and agent interactions documented in real time. No exaggeration. Just level zero truth.