A new malware has been discovered, it infects other jars inside server folder (plugins, server jar...). The malware creates a service "vmd-gnu" to maintein a persistent access.

If you find: java.net.NoRouteToHostException: No route to host in your server logs probably you are infected.

You can use this command (from linux) to check if you are infected: grep -R "plugin-config.bin" .

I developed a tool to check all your jars inside server folder and clean them.


ATTENTION! ( 04/25/2023 )
The Skyrage malware has been offline for some time, but has recently come back online with an updated version. Therefore I was forced to update the tool used to clean our OS. Anyone who has experienced problems with Skyrage in the last 2-3 weeks should download the tool and scan their Windows operating system. Please note that the tool is currently in beta, so please let me know via Discord if you encounter any issues.

How to use:
1. Stop your server
2. Put tool where you want (I recommend server folder)
3. Start it with: "java -jar MalwareSkyrageRemover.jar 5" (where 5 is custom thread number, default is 4)
4. Press Y to clean your system
5. Press Y to clean your jars
6. Press Y to replace jars (If you type N the infected plugins will be renamed in PluginName-infected and the new clean plugins in PluginName-clean)

Malware details: https://forums.papermc.io/threads/malware-announcement.529/





Info and support: https://discord.io/hoxija
Telegram: https://t.me/HoxijaChannel