cPanel Server Crypto Mining Compromise

At a glance#

• Purpose: Identify, contain and remediate a crypto-mining compromise on a cPanel server.
• Applies to: cPanel & WHM on Linux.
• Risk: High - incident response on a live production server.
• Time: Several hours; full rebuild may be required.

Date#

April 10, 2026

Server Context#

• Environment: cPanel/WHM server
• User affected: volkswagen
• Application: Node.js (Next.js)
• Path: /home1/volkswagen/volkswagen.com.np

The server experienced sustained high CPU usage due to unauthorized execution of a cryptocurrency mining process.

The process was identified as:

• XMRig (Monero miner) running from a user directory
• Consuming approximately 3000% CPU across multiple cores

Initial Symptoms#

• CPU usage above 95%
• Load average around 4.3
• Noticeable server performance degradation

Key Evidence#

/home1/volkswagen/volkswagen.com.np/xmrig-6.24.0/xmrig

Indicators of Compromise (IOCs)#

• xmrig-6.24.0/ directory
• mon.sh execution script
• btu, mist binaries
• .check_miner.lock file
• Obfuscated filenames
• kal.tar.gz archive

Primary Root Cause#

Remote Code Execution (RCE) vulnerability in the Node.js application (server.js)

Attack Chain#

1. Initial Access#

• Attacker exploited a vulnerable endpoint in the Node.js application
• Possible vectors:
  • Unsafe file upload handling
  • Command injection via child_process
  • Unauthenticated or poorly validated API routes

2. Execution#

• Attacker obtained shell-level execution under the volkswagen user

3. Payload Deployment#

• Downloaded archive (kal.tar.gz)
• Extracted mining software (xmrig-6.24.0)
• Used script (mon.sh) to launch miner using nohup

4. Workspace and Temporary Files#

• Created attacker workspace:

`` /home1/volkswagen/.cagefs/tmp/.mkjsddfigdfgufg/ ``

• Stored:
  • IP lists
  • password files
  • socket files

5. Execution Behavior#

• Miner executed continuously
• No cron-based persistence detected
• Likely triggered through application-level execution

From main.log:

xmrig-6.24.0/
xmrig-6.24.0/xmrig
Starting with nohup...

Additional observations:

• Download activity from within the application
• Script execution traces
• Node.js application logs indicating injected commands

Immediate Containment#

• Terminated mining process
• Removed all malicious binaries and scripts

Cleanup#

• Deleted:
  • xmrig-6.24.0/
  • mon.sh, btu, mist
  • payload archives
• Removed attacker workspace:

`` /home1/volkswagen/.cagefs/tmp/.mkjsddfigdfgufg ``

• Verified:
  • No active malicious processes
  • No cron jobs for persistence
  • No recent suspicious file modifications

Hardening#

• Secured environment file:

`` chmod 600 .env ``

• Corrected file permissions:

`` find . -type d -exec chmod 755 {} \; find . -type f -exec chmod 644 {} \; ``

Potential Impact#

• High CPU utilization affecting performance
• Possible exposure of sensitive data:
  • Database credentials
  • API keys
  • environment variables

Risk Level#

High — confirmed remote execution capability

Credential Rotation (Mandatory)#

• cPanel credentials
• SSH access
• FTP accounts
• Database passwords
• API keys

Application Security Improvements#

Required Actions#

• Review and remove unsafe usage of:

``jsx child_process.exec() spawn() ``

• Validate all user inputs
• Secure file upload functionality:
  • restrict file types
  • store uploads outside web root
  • implement scanning

Deployment Hygiene#

• Redeploy clean code from version control
• Remove existing build artifacts:

`` rm -rf node_modules .next ``

• Reinstall dependencies:

`` npm install npm run build ``

Infrastructure Hardening#

Recommendations#

• Install and configure firewall (e.g., CSF)
• Use reverse proxy (e.g., Nginx)
• Implement rate limiting
• Disable unused services

Monitoring#

Implement:

• CPU usage alerts
• Process monitoring
• File integrity monitoring

• Application-level vulnerabilities can lead to full system compromise
• Cryptocurrency miners are often secondary payloads
• Excessive file permissions (e.g., 777) increase risk
• Log analysis is essential for tracing attack behavior

• Malware removed
• No active mining processes
• No persistence detected
• Application requires security review
• Credential rotation pending

• Check system load and CPU usage
• Identify abnormal processes
• Terminate malicious processes
• Locate and remove payload files
• Inspect cron jobs
• Search for recently modified files
• Review logs
• Remove attacker workspace
• Correct file permissions
• Rotate credentials
• Audit application code

This incident represents a successful application-level compromise rather than a simple malware infection.

Long-term prevention requires:

• secure coding practices
• proper server hardening
• continuous monitoring