I got hacked, my server started mining Monero this morning.
My Server Started Mining Monero This Morning
Or: How I learned that “I don’t use Next.js” doesn’t mean your dependencies don’t use Next.js
8:25 AM: The Email
I woke up to this beauty from Hetzner:
Dear Mr Jake Saunders,
We have indications that there was an attack from your server. Please take all necessary measures to avoid this in the future and to solve the issue.
We also request that you send a short response to us. This response should contain information about how this could have happened and what you intend to do about it. In the event that the following steps are not completed successfully, your server can be blocked at any time after the 2025-12-17 12:46:15 +0100.
Attached was evidence of network scanning from my server to some IP range in Thailand. Great. Nothing says “good morning” like an abuse report and the threat of getting your infrastructure shut down in 4 hours.
Background: I run a Hetzner server with Coolify. It runs all my stuff, like my little corner of the internet:
... continue reading