How Did Aqua Catch a Cryptomining Attack Hiding in Memory?

Aqua detected and reconstructed a multistage fileless cryptojacking campaign leveraging a Next.js exploit to execute loaders directly in memory (memfd:), unpack packed stages, drop an XMRig miner (sometimes to /tmp), establish persistence via cron/init scripts and SSH keys, and use anti-removal techniques (chattr +i); the report includes file hashes, C2/staging hosts, and recommends enabling runtime enforcement controls (block fileless execution, drift prevention, cryptomining detection and process-level egress controls).