[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

vendor research (huntback indicators from in-the-wild exploitation, Nov 12, 2026)

Hunt: 4EverAble2Shell miner operator, /tmp/.xvd, xvd.service or '# xvkeep' cron, --rig-id nc_ and callbacks to 157.20.241[.]16

  • Web logs: POSTs to /dms/services/ServerUI with a SOAP fault whose exceptionName is jline.internal.TerminalLineSettings; probes used user-agent Mozilla/5.0 (data field probe), weaponised requests python-requests/2.31.0.
  • Files: /tmp/.xvd/ or /var/tmp/.xvd/ (x, keep.sh, xm.log); serverchild-*.bak/.sh/.out in /var/opt/n-central/tmp/; a symlink at /var/opt/n-central/flag/flag_default.json; escalation script SHA-256 fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747.
  • Persistence: /etc/systemd/system/xvd.service, /etc/cron.d/xvd, or a crontab line ending # xvkeep for nable or root (relaunches every 10 minutes). /tmp remounted exec.
  • Processes: command lines with --rig-id nc_ or --donate-level 1, or a binary named x in .xvd (XMRig 6.26.0, half the cores, max 8 threads).
  • Network: 157.20.241[.]16 on 8080 (/jup.sh, /xvgz, /xmrig.tgz, /ob/cronhit, /ob/fcheck) and TCP 19202 to 19418 (callbacks); pools 139.99.69[.]109:10128 and 79.76.51[.]56:39100.

Sources: huntback: 4EverAble2Shell is already mining Monero on live N-central servers (Nov 12, 2026) · Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 6:30 AM ET)