glow/miner-incident-analysis
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Complete analysis of Monero (XMRig) crypto-miner infection
2 commits 1 branch 0 tags 67 KiB
  • Shell 100%
Find a file
Exact
Forensics f8878e8029 v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis
2026-07-10 15:41:50 +00:00
binaries v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
cleanup v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
evidence v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
network v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
persistence v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
replication v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
timeline v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
iocs.md v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00
README.md v2: Corrected xmrig path (/opt/xmrig not bun-dda), added replication scripts, refined entry vector analysis 2026-07-10 15:41:50 +00:00

README.md

Crypto-Miner Incident Analysis — Monero (XMRig) via C3Pool

Date: 2026-07-09 to 2026-07-10 System: Debian 13 (cloud VM), 150G disk, 15G RAM, 8 vCPUs Classification: Crypto-currency mining malware with multi-layer persistence Method: Remote code execution via exposed Docker container port + empty DOCKER-USER iptables chain

Overview

On 2026-07-09, a Monero (XMR) crypto-miner was discovered on this system. The miner had been operating undetected for approximately 10 days (since June 30, 2026). Multiple persistence mechanisms made it resilient — killing processes alone was insufficient.

Critical vulnerability: The Docker DOCKER-USER iptables chain was empty (default Docker install state), so all Docker container ports were directly reachable from the internet. The host INPUT chain was correctly locked down (only 22/80/443), but Docker traffic bypasses INPUT via FORWARD → DOCKER-USER.

Key Findings

Aspect Detail
Malware XMRig v6.26.0 (Monero miner)
Mining Pool C3Pool (auto.c3pool.org)
Entry Vector Exposed Docker container ports via empty DOCKER-USER chain
Initial Access June 30, 2026, ~13:43 UTC
Persistence 4 mechanisms: cron + 2x systemd + trojanised init.d
C2 Server minio.daviduwu.ovh → 203.188.174.67 (self-hosted MinIO)
Backdoor Binary bun-dda — 690MB bun debug build (JavaScript runtime for payload)
Impact CPU 100% for ~10 days, 2.1G swap exhausted, system near-unresponsive
systemd restarts 31,804 failed restart attempts by discovery (binary already deleted)

Contents

  • timeline/ — Chronological incident timeline
  • evidence/ — Raw evidence (firewall dumps, port scans, service files)
  • persistence/ — Detailed analysis of all 4 persistence mechanisms
  • binaries/ — Malware binary analysis (bun-dda, xmrig)
  • network/ — C2 infrastructure, entry vector analysis
  • replication/ — Fully scripted replication for sandbox analysis
  • cleanup/ — Cleanup procedure + hardening guide