Hi everyone,
We wanted to alert the community about what appears to be an active attack campaign targeting self-hosted ERPNext/Frappe instances.
Over the last 24–48 hours, we’ve observed the same indicators of compromise (IOCs) across 30+ self-hosted ERPNext/Frappe sites that we manage. We’ve also heard similar reports from other ERPNext administrators, so we’re trying to determine how widespread this is.
What we’ve observed
1. Suspicious Administrator login
A successful Administrator login originating from:
111.90.158.58
(server1.kamon.la)
2. Malicious Server Scripts created
Server Scripts are being created automatically with names similar to:
wm_rce_esc
../../zzrcetd154b9y/__init__
../../zzrcewdtolz7d/__init__
3. Payload attempts to download XMRig
The malicious script attempts to download and execute a crypto miner from:
http://111.90.158.58/xmrig/...
http://111.90.139.202/xmrig/...
4. Canary / IOC string
The following string appears inside the malicious script:
WMRCE79772
Quick Checks
Check for suspicious Server Scripts
SELECT name, creation, owner, disabled, script_type
FROM `tabServer Script`
WHERE name LIKE 'wm_%'
OR name LIKE '%zzrce%'
OR name LIKE '%../%';
Check whether XMRig is running
ps aux | grep xmrig
Check for additional artifacts
ls -la /var/tmp/.frappe_bench_health*
Questions for the community
If you’ve experienced something similar, could you please share:
-
Frappe version
-
ERPNext version
-
Self-hosted or Frappe Cloud?
-
Was Administrator login observed?
-
Were any malicious Server Scripts created?
-
Did XMRig actually execute?
-
Any additional IOCs or indicators you’ve discovered?
At this point, we’re trying to determine whether this is:
-
a newly disclosed vulnerability,
-
compromised Administrator credentials,
-
or a broader attack campaign affecting self-hosted deployments.
Any logs, findings, or confirmation would be greatly appreciated. Hopefully we can work together to identify the root cause and help protect other ERPNext users.
Thank you.
