Post

Had to sift through some metrics, but eventually found the outlier, a NextJS container using 2 vCPU and 3GB ram. Once I got to a shell, the problem was pretty clear: in addition to the expected Node processes, there was a process running from /tmp/.libsystem/node and—uh oh! Netcat.

Netcat (nc) is a utility for making network connections, but is also used—as in this case—to establish remote access by malicious actors. It's convenient for that, too, because it's already present on most Linux systems.

I tried to inspect its available /proc/<pid> info, but either got nothing back or permission denied. Not sure what was up with that, but I'm sure I have more to learn there. Netstat showed a connection to we.love.servers.at.ioflood​.net—super legit looking. I suspect C2, but I left it alone.