Recurrence of the crypto-miner botnet in the Forgejo container on the primary VPS
(88.208.212.211). The root cause was finally identified: a Forgejo/Gitea
git-apply path-traversal RCE (crafted git push → overwrites hooks/post-index-change).
The earlier 2026-08-11 cleanup (see
Security Incident: Kinsing Miner in Forgejo Container)
contained the miner but did not close the entry vector, so the attacker re-exploited
and re-installed the botnet. This time the RCE was patched, the attacker's footprint was
purged, and credentials were rotated.
opencode (run as root on the VPS) repeatedly stalling on the 4-core host.git user:
./ksmd -c 1000 -t 12s -shuffle — XMR miner masquerading as the kernel ksmd daemon../javab (×4) and ./bob2 — SSH brute-force spreaders with dozens of outboundApplied patch to 'hooks/post-index-change' — the knowngit apply during repo push.testpoc*,sec4ed00bd294, poc_0c6f55, pfe7a4253) and 239 private malware repospoc-*/spoc-*/test-*) created to test the exploit. Registration was left enabled,codeberg.org/forgejo/forgejo:14.0.5 (latest of the 14.0 branch)/root/forensics/ on the VPS)/tmp/.dlskdjsfweruwerwer/ds/,/tmp/.dmfsdfiweweruwerw, /tmp/.idos, /tmp/.kklfskdfsdifsdf,/tmp/.pingodogidfgwerwe, /tmp/.pinoosfusierewerwer — containing ksmd (miner),javab/bob2 (brute-forcers), esocket5, mass-scanner binaries, do/pass.txtips.txt/22/203 (target IP/domain lists), ds.tgz (dropper)./data backup + 253-account user list + payload dirs archived under/root/forensics/backup/.ksmd/javab/bob2 processes inside the container, thendocker stop forgejo to halt mining + scanning egress and prevent re-triggering.14.0.5 → 16.0.2 (closes the RCE). DB migratedforgejo admin user delete --purge. Remaining: 7 users, 13 legit repos.INTERNAL_TOKEN/LFS/OAuthDISABLE_REGISTRATION = true (app.ini), Forgejo web port 3000 re-bound0.0.0.0 to 127.0.0.1 (nginx on git.veripath.co.uk still fronts it; port 2222/tmp empty; host sweep clean.opencode responsive.git.veripath.co.uk (HTTP 200) and git-over-SSH (port 2222) confirmed working.matthew, studio) in the Forgejo UI.docker-push, client-pull, nuxt-studio-proxy-v2,matthew-local-key) — the attacker had DB access./root/forensics/backup/.Watch for reappearance: ksmd/javab/bob2/esocket* processes, .fadea*.so in
/tmp, ds.tgz downloads, outbound port-22 scanning, or new testpoc*/random-hex users
in the Forgejo DB. CPU guard logs to /var/log/cpu-guard.log.
After remediation, all other infrastructure hosts were swept for the botnet toolkit
(ksmd/javab/bob2/esocket*/atd*/.fadea*.so/ds.tgz/staging dirs), plus
docker containers, crontabs, systemd services, SSH keys and accepted-login history.
| Host | Role | Load | Result |
|---|---|---|---|
| 88.208.212.211 | Main VPS | ~0.4 | Infected — remediated (see above) |
| 212.227.199.114 | Docker host | 0.06 | Clean — no containers running, only SSH + port-forward tunnels |
| 194.164.18.33 | Client VPS | 0.11 | Clean — Orthanc / MinIO / client_db |
| 77.68.97.101 | Client DB host | 0.17 | Clean — postgres + SSH only |
All accepted SSH logins across the clean hosts are from 78.149.209.31 (admin desktop)
or 88.208.212.211 (main VPS / automation). No attacker IPs, no toolkit artifacts in
shell history. The compromise appears to have been isolated to the Forgejo container on
the main VPS.
Outstanding hardening for client hosts:
194.164.18.33 / 77.68.97.101 (shared via chat during the sweep).0.0.0.0:5432 — restrict to trusted IPs.Post-remediation review of stale conntrack state surfaced that the forgejo_db
container had made outbound SSH connections to external IPs during the incident
window — an attacker pivot from the compromised Forgejo container to its own
database container. Findings and status:
forgejo_db to external IPs on port 22security/security-strategy §3 — Forgejo stackforgejo, forgejo_db and forgejo_redis; onlyegress-monitor.sh (every 5 min, conntrack) alerts on any:22 and any forgejo-stack external egress; anomaly-alert.sh