David "DV" Verzolla

tech

[David "DV" Verzolla @dverzolla]

Practice as if you are the worst, perform as if you are the best. --Anonymous

[David "DV" Verzolla @dverzolla]

@wayze187 Legend says he swallowed a metronome as a child.

[David "DV" Verzolla @dverzolla]

The Interactive Handbook on Data Structures and Algorithms (Alt) https://t.co/66TYZ6zCdc via @YouTube

[David "DV" Verzolla @dverzolla]

@tem_que_dizer Sigmund Freud da shopee

[David "DV" Verzolla @dverzolla]

@udreyke descendo depois do shoryuken

[David "DV" Verzolla @dverzolla]

@K8sArchitect Awesome. But, this could be a event from kube itself. Avoiding the usage of external tools from the most primitive update on cm and secrets. A “normal” event from events api maybe?

[David "DV" Verzolla @dverzolla]

@martboficial Levou muito!

[David "DV" Verzolla @dverzolla]

@andre_barcinski Aconteceu o mesmo com a terabyteshop.

[David "DV" Verzolla @dverzolla]

Passou um tornado em Campinas?#chuva #campinas

[David "DV" Verzolla @dverzolla]

@duborges I firewall can handle everything /s

[Eduardo Borges @duborges]

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1) The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe

[David "DV" Verzolla @dverzolla]

kernel revolution #ebpf #cilium https://t.co/7BZEs35nHm

[David "DV" Verzolla @dverzolla]

eBPF Research Papers #ebpf https://t.co/96Clw2Im2g

[David "DV" Verzolla @dverzolla]

hidden gem https://t.co/94ZdDt4Z40

[David "DV" Verzolla @dverzolla]

That's the way to get otg cable (+ keyboard) working in banana pi m2 zero: https://t.co/79vU1USSHm

[David "DV" Verzolla @dverzolla]

@Alph_Utd Rogerio Ceni, The Goalkeeper with most goals in history. https://t.co/W6NLVDnNyC

[David "DV" Verzolla @dverzolla]

“If silence unsettles you, it’s not the quiet that’s the problem—it’s what it reveals.”

[David "DV" Verzolla @dverzolla]

@patdennis missing bitchx

[David "DV" Verzolla @dverzolla]

@rodrigo_draf @DanielDonda Boa. Qnd usava Windows era a minha opção.

[David "DV" Verzolla @dverzolla]

@ArthNRick @DuduMonsanto @Uber_Brasil Mto boa a dica. Uso bastante o flash. Outro dia até cogitei enviar um item caro usando a opção de seguro, mas a outra parte não confio e acabamos usando outro meio. @Uber_Brasil, precisa melhorar as questões levantadas nessa thread viu!?

[David "DV" Verzolla @dverzolla]

Moving windows in some Linux X11 is a brezzy: Hold a key, and hover the mouse above that window. Without needing to click in a specific place. I was looking something similar to macos and found https://t.co/Q5EC6LiTMx #BetterSnapTool