This is an automated archive made by the Lemmit Bot.

The original was posted on /r/monero by /u/not420guilty on 2024-02-11 03:46:53.

Today I noticed that my mining hashrate was low. Looking closer I found a second miner running - in my gitlab docker container.

git 6621 1 99 23:39 ? 00:02:19 ./linuxsys

Hm, that looks familiar. But its not actually there to look at:

$ cat /proc/6621/environ

PATH=/opt/gitlab/bin:/opt/gitlab/embedded/bin:/bin:/usr/binGID=998PWD=/var/opt/gitlab/gitlab-workhorseSSL_CERT_DIR=/opt/gitlab/embedded/ssl/certs/SHLVL=1HOME=/var/opt/gitlabUID=998OLDPWD=/var/opt/gitlab/gitlab-workhorse_=./linuxsys

$ ls -lart /var/opt/gitlab/gitlab-workhorse/linuxsys

ls: cannot access '/var/opt/gitlab/gitlab-workhorse/linuxsys': No such file or directory

Monitoring the container it see it fetching and running this:

http://223.112.201.18:8082/attachment/3537891888/linuxsys

First search on google shows the cause:

Be safe out there.