---
title: Hunt: 4EverAble2Shell miner operator, /tmp/.xvd, xvd.service or '# xvkeep' cron, --rig-id nc_ and callbacks to 157.20.241[.]16 | ctxsec
url: https://ctxsec.com/items/hunt-4everable2shell-xmrig-jup-sh-xvd-xvkeep-157-20-241-16-nc-rig-id
description: "Indicators huntback recovered from the live exploitation of N-central 4EverAble2Shell. They complement the PoC-based indicators Huntress published earlier."
status: "vendor research (huntback indicators from in-the-wild exploitation, Nov 12, 2026)"
published: 2026-11-12
---

> Indicators huntback recovered from the live exploitation of N-central 4EverAble2Shell. They complement the PoC-based indicators Huntress published earlier.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-4everable2shell-xmrig-jup-sh-xvd-xvkeep-157-20-241-16-nc-rig-id.md)

vendor research (huntback indicators from in-the-wild exploitation, Nov 12, 2026)

2026-11-12 3:39 PM ET

### Hunt: 4EverAble2Shell miner operator, /tmp/.xvd, xvd.service or '# xvkeep' cron, --rig-id nc_ and callbacks to 157.20.241[.]16

- **Web logs:** POSTs to `/dms/services/ServerUI` with a SOAP fault whose `exceptionName` is `jline.internal.TerminalLineSettings`; probes used user-agent `Mozilla/5.0` (data field `probe`), weaponised requests `python-requests/2.31.0`.
- **Files:** `/tmp/.xvd/` or `/var/tmp/.xvd/` (`x`, `keep.sh`, `xm.log`); `serverchild-*.bak/.sh/.out` in `/var/opt/n-central/tmp/`; a symlink at `/var/opt/n-central/flag/flag_default.json`; escalation script SHA-256 `fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747`.
- **Persistence:** `/etc/systemd/system/xvd.service`, `/etc/cron.d/xvd`, or a crontab line ending `# xvkeep` for nable or root (relaunches every 10 minutes). `/tmp` remounted exec.
- **Processes:** command lines with `--rig-id nc_` or `--donate-level 1`, or a binary named `x` in `.xvd` (XMRig 6.26.0, half the cores, max 8 threads).
- **Network:** `157.20.241[.]16` on 8080 (`/jup.sh`, `/xvgz`, `/xmrig.tgz`, `/ob/cronhit`, `/ob/fcheck`) and TCP 19202 to 19418 (callbacks); pools `139.99.69[.]109:10128` and `79.76.51[.]56:39100`.

Sources: [huntback: 4EverAble2Shell is already mining Monero on live N-central servers (Nov 12, 2026)](https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers) · [Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 6:30 AM ET)](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains)