I got hacked, my server started mining Monero this morning. | Unfinished Side Projects
https://blog.jakesaunders.dev/my-server-started-mining-monero-this-morning/
TL;DR
Umami analytics (built with Next.js) had an RCE vulnerability.
Got exploited, installed cryptominers
Mined Monero for 10 days at 1000%+ CPU
Container isolation saved me because it ran as non-root with no mounts
Fix: docker rm umami and enable firewall
Lesson: Know what your dependencies are built with, and configure containers properly