It was supposed to be a relaxing Friday evening.

Instead, I received an alarming message from my cloud provider:

"A large amount of outbound traffic is being generated from your server to a Chinese IP address."

I immediately connected to the server via SSH.

The CPU usage was nearly 100% .

What followed was approximately 15 hours of incident response , involving cryptocurrency miners, hidden systemd services, multiple persistence mechanisms, a remote management backdoor, and a suspected Next.js vulnerability.

Here's what happened, what I discovered, and what I learned.

1. The Incident Begins

Friday, December 5, 2025

After receiving the warning from my cloud provider, the first thing I did was run:

top

Enter fullscreen mode

Exit fullscreen mode

One process immediately caught my attention:

PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 2096450 root 20 0 7820 1368 1168 R 93.3 0.0 strings

Enter fullscreen mode

Exit fullscreen mode

Wait...…