errvnd retweeted
i've been hacked
and traced the malware's wallet to see how much money they actually made from this new exploit
(if you use Next.js/React, READ THIS!)
I woke up to a terrifying email from Hetzner: "Netscan Detected."
my server was blocked and a botnet was using my IP to attack others
i dug into the logs and what I found the anatomy of the attack:
1) The Symptoms: I logged into htop and saw the mess:
- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands
my server wasn't serving my app anymore; it was mining crypto for someone else!
2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container
the malware was sophisticated
it renamed itself nginxs and apaches to look like web servers
it even had a "killer" script that hunted down other hackers' miners to kill the competition
3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point
(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)
but the fatal error was mine: my Docker container was running as ROOT
Coolify deploys like this automatically when using Nixpacks, and I never changed it...
so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots
meaning, it was able to infect my whole server, from a single Next.js docker!
4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..
- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)
5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.
but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:
- RUN adduser --system nextjs
- USER nextjs
if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon
check your containers NOW. Run: docker exec id
(or get the full list first: docker stats --no-stream)
If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.
(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)
6) The Money: I dug deeper and recovered the config file (c.json)
- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org
and ofc i tracked the hacker’s wallet on the mining pool
7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet
they are burning the CPU of 400+ cloud servers... to earn...
guess how many millions?
$4.26/day
on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.
i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin
im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...
PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec
stay safe
errvnd retweeted
The cognitive dissonance even among the seemingly smart ones are massive! Its unbelievable how cultural baggage totally distorts any rational thoughts. People are clinging on to these false beliefs thinking their whole identity depended on it. It doesn't.
errvnd retweeted
Yesterday, my account was hacked for a while and strangely, my most viral tweet was deleted. So here it is, updated for 2025 for science and health-illiterates.
To summarize:
1. One whole egg with yolk a day does not increase blood cholesterol
2. Green tea does not help you lose weight
3. Jaggery, honey or sugarcane are not healthier than white sugar
4. There is no "healthy alcohol"
5. Ashwagandha does not reduce stress or help you sleep
6. Shilajit is a resinous piece of rock that does not benefit male sexual health
7. Turmeric in milk does not get beneficially absorbed in body and is lost in stool
8. You can consume fruits anytime during day or night
9. Sugarless black coffee at least 3 cups is good for fatty liver disease
10. Apple cider vinegar is good for only trapping fruit flies
11. Eight glasses of water a day is a myth
12. Pure whey protein supplementation to target recommended higher protein intake is safe for liver and kidneys
13. Magnesium supplements don't help you sleep
14. Anti-ageing is a myth
15. Herbalife products are the most common cause of liver injuries globally in the context of herbal and dietary supplements induced liver damage
16. Just because you lost weight by whatever means does not make you a "health coach."
17. Consumption of dairy along with fruits is perfectly fine
18. Yoga does not help you lose weight
19. Multivitamin a day does not improve health or prevent diseases in general. It can however, increase the risk of multiple cancers
20. Biotin does not help in hair growth or increase length of hair
21. Here are some liver supplements that you are wasting time and money on - Milk thistle, TUDCA and S-adenosyl methionine (SAMe)
22. The liver detoxes you, you don't detox the liver
23. Do not insult the kidneys by drinking yours or others urine, thinking urine therapy is going to help you live longer
24. Your favourite celebrity is always wrong about healthcare. Do not take medical advice from a pretty looking heroine or macho looking hero.
25. Virat Kohli and Cristiano Ronaldo do not drink Herbalife shakes. They just pose with it, for money
26. BluePrint is Bryan Johnson's online supplements scam
27. Covid vaccines ended the pandemic
28. Ayurveda is a pseudoscience. So is Homeopathy, Siddha, Unani, Naturopathy, Reiki, and Acupuncture.
29. Homeopathy is mostly alcohol, sometimes sugar. Other times cockroach parts.
30. You personal experience is not scientific evidence.
errvnd retweeted
Did you know that until 2022 any installed app on Android could see all other apps on your phone without permission? Now, devs need to declare which apps they need visibility to in AndroidManifest.xml
I was curious to see which Indian apps were spying on my installed apps 👇
errvnd retweeted
Remember when Beijing was always so smoggy that it was impossible to see a few feet in front of you?
That's basically fixed.
Since 2013, PM2.5 is down 64%, NO2 is down 54%, SO2 is down 89%, and instead of having just 13 clear days a year, they now have more than 300.
