{
  "id": 19291815,
  "title": "My Server Got Hacked: 15 Hours Fighting Crypto Miners and Hidden Backdoors",
  "url": "https://urgent.news/2026/11/10/my-server-got-hacked-15-hours-fighting-crypto-miners-and-hidden",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-11-10T06:00:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/moonjikwang/my-server-got-hacked-15-hours-fighting-crypto-miners-and-hidden-backdoors-f9l"
  },
  "original_language": "en",
  "account": "On December 5, 2025, a server owner experienced a troubling security incident after receiving an alarming alert from their cloud provider regarding high outbound traffic to a Chinese IP address. The owner, upon investigating, found that a process named \"strings\" was consuming nearly 100% of the CPU, causing the script to keep reappearing every time it was terminated.\n\nFurther investigation revealed a shell script located at /dev/health.sh, which was continuously scanning for and terminating processes matching specific patterns, including \"xmrig,\" \"watcher,\" \"softirq,\" \"rondo,\" and \"/tmp/a.\" The script appeared to eliminate competing mining operations to maintain exclusive access to the server's computing resources.\n\nThe critical mining payload was found at /dev/shm/bts, containing a bash script that killed existing mining processes, downloaded a mining executable and configuration file from an attacker-controlled server, made the downloaded executable runnable, and launched the miner in the background. The script also recreated the missing health.sh file if it was not present.\n\nThe miner's execution flow involved killing existing xmrig processes, downloading a mining executable and configuration file, making the downloaded executable runnable, launching the miner in the background, and recreating the health.sh file if it was missing. The attacker left a humorous message \"MEOWWWWWWWWW\" in the script.\n\nThe threat was not contained after the first attempt at removal. On December 6, 2025, the CPU usage had spiked to 200%, and a new suspicious process named \"p9gzSA\" was running. This process was linked to a hidden systemd service, which was not a part of the initial system configuration and ran with root privileges, allowing it to persist even after attempted removal.",
  "summary": "It was supposed to be a relaxing Friday evening. Instead, I received an alarming message from my cloud provider: \"A large amount of outbound traffic is being generated from your server to a Chinese IP address.\" I immediately connected to the server via SSH. The CPU usage was nearly 100% . What followed was approximately 15 hours of incident response , involving cryptocurrency miners, hidden…",
  "key_points": [
    "Server owner discovered high outbound traffic to Chinese IP on Dec 5, 2025",
    "Hidden shell script terminated competing mining processes on Dec 5, 2025",
    "Root-privileged hidden systemd service persisted after removal on Dec 6, 2025"
  ],
  "editors_take": "Automated scripts that actively terminate competing processes and recreate deleted files represent a sophisticated shift toward persistent, self-healing malware designed to monopolize server resources for unauthorized cryptocurrency mining.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}