Dartnode Unauthorized SSH Access

barbaros

@JohnnySac said:
I see a similar thing. On DartNode VPS's that I installed from ISO myself are fine, but the ones I did not get around to setting up yet (still using their Ubuntu 24.04 template) have had their .ssh/authorized_keys files cleared so I couldn't log in with my SSH key. And .bash_history is symlinked to /dev/null. Like OP I see the last person logged in is:

Last login: Sun Sep 27 13:17:32 2026 from 104.28.237.19

I don't see any crypto miners running but someone was def was messing around with it.

Edit: After restarting it I see the miner running named as /usr/local/lib/.system-update/systemd-journald

Don't forget to cat /usr/local/lib/.system-update/config.json to see wallet address. Probably same dude.

keoir

If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look

Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system.

And yes we're working on a install with ssh public keys

Crunchy7761

@barbaros said:

@JohnnySac said:
I see a similar thing. On DartNode VPS's that I installed from ISO myself are fine, but the ones I did not get around to setting up yet (still using their Ubuntu 24.04 template) have had their .ssh/authorized_keys files cleared so I couldn't log in with my SSH key. And .bash_history is symlinked to /dev/null. Like OP I see the last person logged in is:

Last login: Sun Sep 27 13:17:32 2026 from 104.28.237.19

I don't see any crypto miners running but someone was def was messing around with it.

Edit: After restarting it I see the miner running named as /usr/local/lib/.system-update/systemd-journald

Don't forget to cat /usr/local/lib/.system-update/config.json to see wallet address. Probably same dude.

{
    "autosave": false,
    "donate-level": 1,
    "cpu": {
        "enabled": true,
        "huge-pages": true,
        "huge-pages-jit": true,
        "hw-aes": null,
        "priority": 2,
        "memory-pool": true,
        "max-threads-hint": 70,
        "asm": true,
        "yield": false
    },
    "randomx": {
        "init": -1,
        "init-avx2": -1,
        "mode": "fast",
        "1gb-pages": false,
        "rdmsr": true,
        "wrmsr": true,
        "cache_qos": false,
        "numa": true,
        "scratchpad_prefetch_mode": 1
    },
    "pools": [
        {
            "url": "pool.supportxmr.com:443",
            "user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
            "pass": "node-[REDACTED]",
            "keepalive": true,
            "tls": true,
            "algo": "rx/0"
        },
        {
            "url": "de.supportxmr.com:443",
            "user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
            "pass": "node-[REDACTED]",
            "keepalive": true,
            "tls": true,
            "algo": "rx/0"
        }
    ],
    "log-file": null,
    "print-time": 0,
    "health-print-time": 0,
    "retries": 5,
    "retry-pause": 3,
    "syslog": false,
    "verbose": 0
}

barbaros

@keoir said:
If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look

Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system.

And yes we're working on a install with ssh public keys

Please consider adding Debian 13 image, and auto run apt update after installation. Default installation comes with too many outdated packages.

Also the wallet shows the ips miners running on, perhaps get in contact with those server owners or just suspend their servers as the miner is abusing your resources.

@Crunchy7761 said:

yeah it's the same wallet.

Crunchy7761

@Neoon said:

@Crunchy7761 said:

@Neoon said:

@OpaqueRegistrant said:
Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

I doubt that dartnode got breached.
If they got breached, we shall see, the next 24h will tell.

every single one of my vpses has access from unknown ips, and barbaros also had it so not sure what other explanation there could be

brother in christ, every single vps, gets fucked by bots, every single day, bruh.

the password is 16 characters with 62 variants per letter, its quite impossible for the same person to have guessed all my vps passwords, and 2 other peoples as well. And since the login method says ssh with password, we can rule out any other exploit as well, since the root password hasn't been changed and its not possible to get the root password once its been set.

@keoir said:
If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look

Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system.

And yes we're working on a install with ssh public keys

As said above, currently there are 3 people which have reported the same issue... The only remaining way that I can see they could have obtained the password is if the panel was hacked or a rogue support agent.

nghialele

@barbaros said: The issue is Dartnode's default Debian 12 (no newer version) shows 300+ apt update, so that install image is quite old.

They told me in ticket that Debian 13 is too early in development for them to deploy in their fleet. Crazy work.

JohnFilch123

had the same miner recently, on around 50 servers, so not just dartnode

bugabuga

Honestly, if you guys are on windows doesn't hurt to just do a quick scan with Malwarebytes! had this happened years back, even AVG AV didn't catch it but MWB did.. Was Zeus keylogger.. I dunno if MWB is still good nowday's but was great back in the day