I noticed that my server CPU is super high and the reason is grep "A"
command
After a deep look, that what I've found in my active internet connections list (netstat -tupn
)
tcp 0 0 138.xxx.140.xxx:60752 198.1.158.134:80 ESTABLISHED 1583/grep "A"
I've killed the task by calling sudo kill -9 1583
then the same IP address made the following connection with a different command
tcp 0 0 138.xxx.140.xxx:32956 198.1.158.134:8000 ESTABLISHED 13139/id
by calling lsof
I found the process name is bkhcdgfdv
with these lines
bkhcdgfdv 14771 14825 root 5r REG 253,1 4516064 57220 /usr/sbin/php-fpm7.1
bkhcdgfdv 14771 14826 root cwd DIR 253,1 4096 2 /
bkhcdgfdv 14771 14826 root rtd DIR 253,1 4096 2 /
bkhcdgfdv 14771 14826 root txt REG 253,1 625878 2100 /usr/bin/bkhcdgfdva
bkhcdgfdv 14771 14826 root 0u CHR 1,3 0t0 6 /dev/null
bkhcdgfdv 14771 14826 root 1u CHR 1,3 0t0 6 /dev/null
bkhcdgfdv 14771 14826 root 2u CHR 1,3 0t0 6 /dev/null
bkhcdgfdv 14771 14826 root 3u IPv4 309207 0t0 TCP MY_HOSTNAME:32982->198.1.158.134:8000 (ESTABLISHED)
Question: What kind of attack is this and how do I stop it?
grep
maps to a monero miner on your system). Try to record the network traffic, and isolate the binary with the weird name before nuking the server, that might be enough to attribute it. – J.A.K. Jul 30 '18 at 7:17ps -fax bkhcdgfdv
to see where is the file that trigger the process. Nuke you server and redeploy after you have enough of the research. – mootmoot Jun 5 '19 at 9:11