Account Number: UK1523400473
Ticket Reference: 6a7eec123474393755151f4f
Server: VPS1143613143 - RAM VPS 4 - primary_vps - 88.208.212.211
Prepared: 2026-08-20
This report is provided in response to the notification of spurious SSH
activity originating from the above server. It explains the cause, the
measures applied, and the verification confirming the matter is resolved.
- On 2026-08-03 an attacker exploited a known path-traversal RCE in the
self-hosted Git service (Forgejo) via a crafted repository push, gaining code
execution inside the Forgejo container on the primary VPS
(88.208.212.211).
- The attacker installed a cryptocurrency miner and SSH brute-force spreading
tools inside the container. The brute-force attempts reported by third
parties between 2026-08-09 and 2026-08-13 originated from those malicious
processes; their traffic is NAT'd to the server's public IP, which is why it
appeared to come from 88.208.212.211.
- Self-service account registration had been left enabled, which is how the
attacker created the accounts used to test the exploit (253 accounts and 239
malicious repositories — all since purged).
- Containment — malicious processes killed and the container halted to
stop mining, scanning and re-triggering.
- Patching — the Git service was upgraded from the vulnerable version
(14.0.5) to a fixed version (16.0.2), closing the entry vector. Image
verified from the official registry.
- Purge — all 253 attacker accounts and 239 malicious repositories
deleted; container rebuilt from a clean, verified image.
- Credential rotation — database passwords, internal tokens, application
secrets, the deploy webhook secret, and passwords for all remaining users
were rotated.
- Hardening — self-registration disabled; the web UI is no longer directly
exposed to the internet (served via reverse proxy only); a per-container
outbound firewall restricts the Git stack to its own database, cache and
webhook — all other outbound traffic, including SSH to any external host,
is blocked, making the reported activity class technically impossible.
- Detection — automated monitoring (outbound-SSH detection every 5
minutes, anomaly and indicator-of-compromise checks every 15 minutes,
process monitoring every 5 minutes, CPU guard every minute) and fail2ban
SSH brute-force protection on both the host and the Git service.
- Sibling servers swept for the same toolkit on 2026-08-14 — all clean;
exposed database ports on client servers subsequently restricted.
| Check |
Result |
| Patched Git service running (16.0.2, clean image) |
Confirmed |
| Re-exploit attempts in application logs since remediation |
None |
| New accounts since 2026-08-14 |
None (7 users / 13 legitimate repositories remain) |
| Miner / brute-force processes, staging directories |
None — container clean, no artifacts |
| Outbound SSH from the Git stack |
Blocked by firewall (only permitted destinations allowed) |
| Outbound SSH connections from the server |
Only to known infrastructure hosts (tunnels) |
| Server load |
Normal (~0.2–0.3 on 4 cores) |
| Monitoring |
All scheduled checks running and reporting; no anomalous outbound since 2026-08-18 23:30 (two alerts investigated and found benign: monitor self-match false positives) |
| fail2ban |
Active — 264 brute-force sources banned on host SSH to date |
| Deploy webhook with rotated secret |
Verified working 2026-08-19 |
| Client servers |
No longer expose PostgreSQL externally |
No recurrence of the reported activity in the six days since remediation
(2026-08-14 → 2026-08-20). The server is operating normally, monitoring
continues, and the incident is considered closed. Please consider the
notification resolved; we are happy to provide further detail if required.
Prepared by VeriPath · 2026-08-20