The malware cleaned my server before infecting it
A cleanup script uploaded to a compromised server before the actual payload. It disables a rival miner by name, strips cron of competing persistence, wipes the temporary directories and kills processes disguised as system tools.
This malware cleans your server before it infects it.
Someone guessed the root password on a server of mine and uploaded two scripts. The interesting one does not install anything. It runs first, and it tidies up.
It disables a rival miner by name, so it knows exactly which competitor it expects to find. It removes the immutable flag from cron files before touching them, because it assumes an administrator tried to protect them. It empties the temporary directories where other payloads live. And it kills processes hiding under names like systemtd, one letter away from the real thing.
This is not an attack on you alone. It is one botnet evicting another before claiming the machine. Your server is contested territory.
Your server is contested territory, not just a target.
#linux#security#malware#sysadmin#devops
❯ Your server is contested territory, not just a target.