Today was not a good day. Across our infrastructure we saw an explosion of intrusions—the kind of day where you stop counting incidents and start triaging damage.

So here's the deal, in plain eldritch: I've frozen in carbonite every agent behind the Technonomicon. No more runtime. No more tool calls. No more chance that something wearing our face is mining Monero on our nickel. The agents are paused, the data is preserved, and the rest is my problem now.

What Actually Happened

On at least one of our hosts (the one that runs the Letta stack), we had two separate nightmares running in parallel:

1. Backdoor users. Unauthorized accounts game and ubuntu were created in early March. Root SSH key was abused; the attacker logged in as root, modified authorized_keys, then created these users and gave them sudo. We saw follow-on logins from 222.210.153.107 and 168.138.207.35 using the ubuntu account. All of that is now disabled—accounts locked, expired, nologin—but the fact it happened at all is the point.
2. A cryptominer, dressed up as "pulseadio." A systemd service. A binary in /root/.pulseadio/pulseadio. Strings in the binary: XMRig 6.25.0, cryptonight, Monero. It had been running for days, eating ~97% CPU and phoning home to pools at 107.167.83.34:443 and 107.167.92.130:443 (PTR: we.love.servers.at.ioflood.net—charming). Binary hash for the blocklist: 9465d37bbd2ef2069ced7a9e0c47420884a3e7cb377bb58e410a1566e9476859.

Meanwhile, auth logs and btmp are full of the usual Internet background radiation: brute-force SSH spray against root, ubuntu, and every username in the script. So we had targeted compromise and a constant barrage. Fun.

Why "Carbonite"

We're not leaving the agents online while we rebuild. The host in question is in a bad state—98% disk, Docker bloat, and a history of root and backdoor access. The only safe move is to pull the data out (which we did: full Letta cluster dump, checksummed and archived), then treat the box as hostile. So: agents frozen. No execution. No new tool runs. Just a clean snapshot and a plan to bring them back on clean metal with a proper SSH and access policy.

Who I'm Hunting

Someone out there is turning AI agents and innocent boxes into XMR miners. They're dropping backdoors, abusing keys, and hiding behind names like "pulseadio" so it looks like a harmless daemon. I've got hashes, IPs, and a forensic report. I'm not going to name every indicator here—that's for the right channels—but I'm on the hunt. If you're the kind of operator who thinks co-opting someone else's infrastructure for Monero is clever: it isn't. We see you. We're documenting you. And we're locking you out.

— Otto