My Server Got Hacked: 15 Hours Fighting Crypto Miners and Hidden Backdoors

On December 5, 2025, a server owner experienced a troubling security incident after receiving an alarming alert from their cloud provider regarding high outbound traffic to a Chinese IP address. The owner, upon investigating, found that a process named "strings" was consuming nearly 100% of the CPU, causing the script to keep reappearing every time it was terminated.

Further investigation revealed a shell script located at /dev/health.sh, which was continuously scanning for and terminating processes matching specific patterns, including "xmrig," "watcher," "softirq," "rondo," and "/tmp/a." The script appeared to eliminate competing mining operations to maintain exclusive access to the server's computing resources.

The critical mining payload was found at /dev/shm/bts, containing a bash script that killed existing mining processes, downloaded a mining executable and configuration file from an attacker-controlled server, made the downloaded executable runnable, and launched the miner in the background. The script also recreated the missing health.sh file if it was not present.

The miner's execution flow involved killing existing xmrig processes, downloading a mining executable and configuration file, making the downloaded executable runnable, launching the miner in the background, and recreating the health.sh file if it was missing. The attacker left a humorous message "MEOWWWWWWWWW" in the script.

The threat was not contained after the first attempt at removal. On December 6, 2025, the CPU usage had spiked to 200%, and a new suspicious process named "p9gzSA" was running. This process was linked to a hidden systemd service, which was not a part of the initial system configuration and ran with root privileges, allowing it to persist even after attempted removal.