How Did Aqua Catch a Cryptomining Attack Hiding in Memory?

Aug 4, 2026 · Original article ↗

Summary

Aqua Nautilus reported detecting a multistage, fileless XMRig cryptojacking campaign targeting containerized Node.js applications built with Next.js. Aqua’s telemetry showed in-memory execution, newly introduced binaries, persistence, and outbound mining traffic; it did not identify the exact exploit used. Aqua reported no evidence that customer secrets, tokens, or keys were accessed.

Key points

The campaign began with code executed through a Next.js exploit, but the available telemetry was insufficient to determine the specific exploit.
The attacker used wget piped to sh to retrieve a first-stage script, then unpacked a loader in memory before the miner was dropped to disk.
Aqua observed new binaries, guard and watchdog processes, persistence through cron jobs, rc.d init scripts and shell profile changes, and an SSH key installed as a backdoor.
The XMRig miner communicated with a Monero mining pool; Aqua associated the outbound activity with the process generating it.
In a later phase, the attacker used chattr +i to make key files harder to remove.
Aqua said its runtime detection surfaced the campaign and described enforcement policies that can block fileless execution, unauthorized binaries, and mining connections.
Aqua reported no evidence of customer secrets, tokens, or keys being accessed. The article says additional indicators are available to customers and security researchers upon request.

Attack Vectors

Code execution through an unidentified Next.js exploit.
Remote script retrieval and execution using wget piped to sh, followed by a loader unpacked in memory.
Persistence through cron jobs, rc.d init scripts, shell profile modifications, and an SSH key.

Defensive Notes

Enable Drift Prevention in enforcement mode for baselined workloads.
Enable Block Fileless Execution where memory-resident execution is not expected.
Ensure cryptomining detections are visible and outbound connections can be associated with their originating processes.
Review authorized_keys files and other persistence locations for unexpected changes.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cts-assets[.]s3[.]us-west-1[.]amazonaws[.]com`	S3-hosted grep2.jpg stager infrastructure.
DOMAIN	`redclub-websites-offer-images[.]s3[.]amazonaws[.]com`	S3-hosted grep2.jpg stager infrastructure.
IPV4	`185[.]216[.]75[.]152`	IP address listed as C2 and staging infrastructure.
IPV4	`221[.]156[.]167[.]200`	IP address of the stage-1 and payload server.
IPV4	`77[.]90[.]13[.]20`	IP address of the identified payload host.
SHA256	`72987d9755dbd12117a23f337054edcc51629563c3ff867fd65ccb948775d546`	SHA-256 hash identified as a packed stage.
SHA256	`82258b64b331d1f0d345292b69da6e6f4381e8c7249654140b2c1167353b534b`	SHA-256 hash identified as the malware loader.
SHA256	`83a9d43c3d37983a551d4b525829b40e8af4de49cfc9524156400f983fd49699`	SHA-256 hash identified as a hidden executable.
SHA256	`b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49`	SHA-256 hash identified as the XMRig miner at /tmp/nodes.
SHA256	`fce7781a199f2b65bdb47dac602ecf397941235670818e79e5d9a9d0fa4cceea`	SHA-256 hash identified as a packed stage.
SHA256	`ff990066f7860be6f2893550e58c0ab485c330edc8a4a55a289557004eb9ef99`	SHA-256 hash identified as a nested Go packer.
URL	`hxxp[:]//185[.]216[.]75[.]152`	Listed as C2 and staging infrastructure.
URL	`hxxp[:]//221[.]156[.]167[.]200:9090/js/`	C2 and staging URL identified as the stage-1 and payload server.
URL	`hxxp[:]//77[.]90[.]13[.]20/dashboard`	Identified as a payload host.