RivasSec

Infrastructure. Security. Insight.

Field notes on infrastructure security, cloud hardening, Kubernetes, IAM, and OSINT by RivasSec.

Finding the Cryptominer Hiding in a Docker overlay2 Layer

Posted on Fri 11 September 2026 in DevSecOps • 11 min read

incident-response
devsecops
docker
forensics

A runtime detector flagged mining but ps and ss came back clean. The miner lived in the image's overlay2 diff layer, relaunched on every container restart.