SSL Private Key Exfiltration via sys.eval and Netcat to 62.171.185.97

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects anomalous process execution patterns where a database process (postgres or postmaster) or a common system utility (nc, python, bash) is observed initiating unauthorized network connections to a known external C2 IP or accessing sensitive cryptographic files (e.g., server.key). This behavior is indicative of potential post-exploitation activity, specifically the exfiltration of credentials or sensitive data via database-level command execution (sys_eval) or direct file manipulation.