Cryptominer planted through the web app, shut down the same day

Context

A public site built in Next.js, hosted on a VPS shared with other projects. CPU pinned at maximum with no traffic to justify it.

Problem

An attacker had gained code execution through the application and started a cryptocurrency miner. The process restarted itself after every kill, and the logs were full of user agents impersonating legitimate crawlers, which sent the investigation down the wrong path.

What I did

1. 01Identified the actual process and the chain it used to gain execution
2. 02Blocked traffic to the mining infrastructure at the firewall before cleaning anything, to stop exfiltration first
3. 03Hunted persistence across every usual mechanism: cron, systemd, profile scripts, shell files, temp directories
4. 04Rotated every secret reachable from the compromised container
5. 05Fixed the vector in the application and brought the stack back up clean
6. 06Separated real signals from false positives generated by spoofed user agents in the logs