Discussion Help:We Found a Bitcoin Mining Prog / Email Server Running on Our Server We saw that load spiked on one of Ubuntu servers yesterday and found this on the proc list using all our cores:statd 7680 690 0.0 743976 58492 ? Sl Nov26 20914:53 ./yam -c 1 -M stratum+tcp://binyu.crypto%40gmail.com:[email protected]:45660/xmrThis was running under the statd user.What do we do? We checked firewall, SSH, all seem OK. How do we go about investigating this breach? Do help! 26 points gopi_ar 10 years ago 25 comments
statd 7680 690 0.0 743976 58492 ? Sl Nov26 20914:53 ./yam -c 1 -M stratum+tcp://binyu.crypto%40gmail.com:[email protected]:45660/xmr
This was running under the statd user.
What do we do? We checked firewall, SSH, all seem OK. How do we go about investigating this breach? Do help!