In PHP programming language there is an open source tool called PhpMyAdmin that handles the administration of MySQL. Access can be denied when access to MySQL is attempted through the root user.

For each targeted IP address, the malware starts scanning for phpMyAdmin, MySQL, FTP, and Postgres services. After detecting an open port accepting connections, it will attempt to log in using ...