cPanel host infected with a miner and a worm, cleaned with no downtime

Context

A shared hosting server carrying sixteen client sites, running cPanel on AlmaLinux. Degraded performance and abnormal outbound traffic.

Problem

The server was running a miner and, on top of that, a worm scanning the internet for other vulnerable cPanel installs — meaning the client’s server was actively attacking other systems. Persistence was installed across five different mechanisms, and some of the suspicious binaries turned out to be legitimate web server components.

What I did

1. 01Full inventory of processes, outbound connections and recently modified files
2. 02Removed persistence from cron, profile scripts, shell files, systemd units and SysV services
3. 03Explicitly separated the false positives — legitimate web server binaries that look like malware to any automated scan
4. 04Stopped the worm and blocked its outbound scanning traffic
5. 05Checked the hosted sites for webshells and injected files