Stealth Crypto Miner Discovered in qBittorrent Docker Container
By
tatoalo
8mo ago· 1 min readenInsight
65/100
Toasty
Bagelometer↗
Crusty in the right places. Worth the chew.
Score65TypeanalysisSentimentnegative
Summary
A developer discovered a stealth crypto miner running inside a hotio/qbittorrent Docker container while migrating to a new server. The suspicious process called 'netservlet' was consuming unusually high CPU resources and had been unlinked from the filesystem, making it difficult to inspect directly. The investigation revealed a compromised container image being used for cryptocurrency mining.
Key quotes
· 4 pulledRecently, while migrating to a new server, I discovered a suspicious process running inside a hotio/qbittorrent Docker container.
While monitoring system resources, I noticed a process consuming unusually high CPU.
The binary netservlet was unfamiliar, and attempts to inspect it via /proc failed.
This indicates the binary was likely unlinked from the filesystem, pretty much as expected.
Short investigation into a stealth crypto miner running in a qbittorrent container
