This has also affected us and we found some things you might want to check for on your server. We didn’t find any new keys added to /root/.ssh/authorized_keys but we found something that had been deposited into our system, so you might want to check:
find / -name "ld.so.preload" 2>/dev/null
find / -name "libnss_cache.so.2" 2>/dev/null
find / -name "__hesti" 2>/dev/null
find / -name "__hesti*" 2>/dev/null
find /lib /usr/lib -name "*.so*" -newermt "2026-05-21" 2>/dev/null
For us, the unauthorised web terminal access was three attempts, all on 21st May, hence why I am looking for libraries from this date on, some legitimate ones may also have been added since then but in our case the only one was the malicious one. These are the objects we found had been added:
a dropper/loader: /usr/lib/__hesti/__hesti
a library: /lib/x86_64-linux-gnu/libnss_cache.so.2
and a preload reference: /etc/ld.so.preload
What this malware appears to be doing:
-
using
LD_PRELOADvia/etc/ld.so.preload -
to inject
libnss_cache.so.2into essentially every dynamically linked process on the system.
This was causing some weird DNS activity, which manifested itself as a slowdown of the panel, and upon investigation we saw hundreds of DNS requests for a domain which was something like p1.678456.xyz. Each lookup was failing and causing timeouts, freezes, etc. Havoc basically!
I can’t explain it fully (deleting the dropper and payload was tricky) as I had to use ChatGPT to help - it’s all a bit beyond my light understanding on web server administration, but at least you might want to check if you have been affected by this particular malware, or at least share details of the version of events that has affected you.
Needless to say, the web terminal is now well and truly DISABLED!