Security Alert: Suspicious Administrator Logins & Crypto Miner Deployment on Multiple ERPNext Server

Hi everyone,

We wanted to alert the community about what appears to be an active attack campaign targeting self-hosted ERPNext/Frappe instances.

Over the last 24–48 hours, we’ve observed the same indicators of compromise (IOCs) across 30+ self-hosted ERPNext/Frappe sites that we manage. We’ve also heard similar reports from other ERPNext administrators, so we’re trying to determine how widespread this is.

What we’ve observed

1. Suspicious Administrator login

A successful Administrator login originating from:

111.90.158.58
(server1.kamon.la)


2. Malicious Server Scripts created

Server Scripts are being created automatically with names similar to:

wm_rce_esc
../../zzrcetd154b9y/__init__
../../zzrcewdtolz7d/__init__


3. Payload attempts to download XMRig

The malicious script attempts to download and execute a crypto miner from:

http://111.90.158.58/xmrig/...
http://111.90.139.202/xmrig/...


4. Canary / IOC string

The following string appears inside the malicious script:

WMRCE79772


Quick Checks

Check for suspicious Server Scripts

SELECT name, creation, owner, disabled, script_type
FROM `tabServer Script`
WHERE name LIKE 'wm_%'
   OR name LIKE '%zzrce%'
   OR name LIKE '%../%';

Check whether XMRig is running

ps aux | grep xmrig

Check for additional artifacts

ls -la /var/tmp/.frappe_bench_health*


Questions for the community

If you’ve experienced something similar, could you please share:

  • Frappe version

  • ERPNext version

  • Self-hosted or Frappe Cloud?

  • Was Administrator login observed?

  • Were any malicious Server Scripts created?

  • Did XMRig actually execute?

  • Any additional IOCs or indicators you’ve discovered?

At this point, we’re trying to determine whether this is:

  • a newly disclosed vulnerability,

  • compromised Administrator credentials,

  • or a broader attack campaign affecting self-hosted deployments.

Any logs, findings, or confirmation would be greatly appreciated. Hopefully we can work together to identify the root cause and help protect other ERPNext users.

Thank you.

2 Likes

@ssiyad @ankush

If it helps, i’m seeing xmrig running on a local instance (not exposed to the internet). I installed frappe using frappe-manager:

➤ ps aux | grep xmrig
frappe       752  0.0  0.0   6480  2016 pts/0    S+   19:32   0:00 grep --color=auto xmrig
The above was a false positive - i was reading the grep response wrong.

For me, your query check comes back empty:

SELECT name, creation, owner, disabled, script_type
    -> FROM `tabServer Script`
    -> WHERE name LIKE 'wm_%'
    ->    OR name LIKE '%zzrce%'
    ->    OR name LIKE '%../%';
Empty set (0.007 sec)

Installed Apps
frappe: 16.29.0 (version-16)
erpnext: 16.29.0 (version-16)
hrms: 16.14.0 (version-16)
frappe_web_push: 0.0.1 (main)

Our instance was also compromised, even after changing the admin password, we are not sure what the loophole is. The scripts were cleard but then it started appearing in the /tmp folder with health-chcek file appearance, deleted those files still they continue to come up. They were crypto mining binaries . They ate up all the cpu credits. I have shut down my instance of erpnext for the time being until i see which version is not affected. I was using v15 and the hacker had put the files in the backend container.

There is a vulnerability reported in June 2026. Looks like this weakness was part of it.

https://www.armadin.com/blog-posts/chaining-stored-xss-to-remote-code-execution-in-erpnext

May we know the output of: bench version, and whether it is a cloud or self hosted instance?

This is self hosted instance.

bench version shows this.

erpnext 15.6.0
frappe 15.5.0
hrms 15.5.0
payments 0.0.1

1 Like

Hello,

I found these scripts on from 2 days ago two different servers and there sites also , They were created by an administrator, possibly because the password was easy to guess.

I think there may be a tool that can generate sites and passwords that could be easy to guss .