PostgreSQL queries from external IP causing high CPU load. Have I been hacked? Since I few days I have noticed that on my Atlassian Software VM (running only Jira, BitBucket and Bamboo) PostgreSQL is causing very high load as seen in htop.



I then checked with

SELECT * FROM pg_stat_activity;


what is running on my system and found two weird entries below.

12405 | postgres    | 15526 |       10 | postgres   |                  | 114.86.94.107 |                 |       56033 | 2017-11-17 15:40:03.745147+00 | 2017-11-17 15:40:04.954341+00 | 2017-11-17 15:40:04.954341+00 | 2017-11-17 15:40:04.954343+00 |                 |            | active |             |      3202367 | select Fun020001 ('./x4000021328 &amp;')
12405 | postgres    | 15539 |       10 | postgres   |                  | 114.86.94.107 |                 |       61953 | 2017-11-17 15:40:12.560015+00 | 2017-11-17 15:40:13.374722+00 | 2017-11-17 15:40:13.374722+00 | 2017-11-17 15:40:13.374724+00 |                 |            | active |             |      3202368 | select Fun020001 ('./ps3991599979 &amp;')


The queries they're running seem weird to me

select Fun020001 ('./x4000021328 &amp;')
select Fun020001 ('./ps3991599979 &amp;')


I then found files named like the two above in

/var/lib/postgresql/9.6/main/

-rwxrwxrwx 1 postgres postgres    14480 Nov 17 15:39 ps3991599979
-rwxrwxrwx 1 postgres postgres   496464 Nov 17 15:40 x4000021328


Do I assume correctly that my machine has been hacked? For now I have disabled remote connections and deleted the binaries. I also turned off the machine. Is there anything else I can do to prevent further abuse of my VM?
After using clamscan to investigate further it found another backdoor installed.

/var/lib/postgresql/9.6/main/base/12405/2613: Win.Trojan.MSShellcode-6360729-0 FOUND


I also found out that PostgreSQL 9.6 has a lot of vulnerabilties, but apt-get wouldn't find a newer version than 9.6. To upgrade to Version 10 you'll need to add 

 deb http://apt.postgresql.org/pub/repos/apt/ sid-pgdg-testing main 10


to your sources in order to upgrade via

 apt-get install postgresql-10