Peter

Just minding my own business

[Eduardo Borges @duborges]

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1) The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe

[jords @jords]

selling rare solana coins (november edition) for $250 each dm me

[Peter @_petrosg]

🤫

[Degen Dojo NFT {⛩️} @DegenDojoNFT]

There's probably not enough $TETO in the entire ecosystem to roll this GODLIKE tome...

[Degen Dojo Community @DojenCommunity]

NFA DYOR but something is coming soon 👀 @DegenDojoNFT

[Peter @_petrosg]

@_Urkann @DegenSweepers @ripmantas @nikolaki18

[Peter @_petrosg]

@MonstaScientist @RoofMonsta @ripmantas @nikolaki18

[Peter @_petrosg]

@Jan1kkk @Primatesnft FUCKING FR

[HGE @HGEABC]

$SOL is up 50% in 6 days 🫡 🫡

🧠🧵

[Peter @_petrosg]

@IcedKnife No, every time is great to work on yourself

[Peter @_petrosg]

@CryptochildNFT @trippinapes B

[Peter @_petrosg]

@cozypront Pretty much

[Minister 🔮 @Ministerr]

i still have faith this man will bring me generational wealth

[Iced @IcedKnife]

this year i lost
- my girlfriend
- my house
- my close friends
- my entire net worth
- my dignity

but at least i gained
- experience
- 200 monkey pictures

[TheS◎Lstice @The__Solstice]

just look at that solana growth trajectory and tell me you don't get rock hard

[Watcher.Guru @WatcherGuru]

McDonald’s after seeing the market crash even more today.

[TheS◎Lstice @The__Solstice]

With prices this low, there's no better time for retail to load up 10 SOL and take their shot at nfts

[Peter @_petrosg]

@Shitcoin_Surfer @rugsurfer @gainzxbt 💀

[T @TorayKortan]

I would like to thank everyone who wore masks whilst driving in the car alone for bringing the pandemic to an end.

Without you, the heroes, we may not have had the privilege of being on Twitter today.

[Peter @_petrosg]

@skwgmi Bro 25 sol is like 800$