CRITICAL SECURITY INCIDENT - Azure Host-Level Compromise

Question

ALL App Services in my subscription — including brand new ones created today — contain a bind-mounted /diagServer directory with a C2 backdoor agent (DiagServer binary) that cannot be removed.

Evidence:

• /diagServer/DiagServer (C2 binary) present on every container
• /run-diag.sh script maintains and restarts the agent
• rm -rf /diagServer fails with "Device or resource busy" confirming it is a host-level bind mount, not container-level
• New App Services created today are immediately infected
• Microsoft Defender for Cloud alerts: "Digital currency mining detected" on multiple App Services

This is a host infrastructure compromise. I need to be moved to a clean host immediately.

Anyone know what to do know. plz help

Answer 1

ok will try checking in another service and changing in location. Thank you

Answer 2

Hi @Rupesh Sangoju

Based on your description, this certainly warrants investigation, but I would avoid concluding that this is a host-level compromise without additional evidence.

A few points to help narrow it down:

The /diagServer directory and diagnostic-related processes may be part of the Azure App Service platform or diagnostic infrastructure. Their presence alone doesn't necessarily indicate a compromise.

The "Digital currency mining detected" alert from Microsoft Defender for Cloud should be treated as a high-priority signal, but it's important to review the alert details (process tree, command line, affected files, MITRE techniques, and evidence) to determine whether it's a true positive or a false positive.

Compare the behavior with a newly created App Service in another App Service Plan or region. If the same artifacts appear everywhere, it's more likely to be platform-related than a tenant-specific compromise.

Review Activity Logs, App Service Diagnostics, Kudu/SCM logs, and Defender for Cloud recommendations to identify when the behavior started and whether any unauthorized deployments or configuration changes occurred.

If Defender for Cloud is consistently reporting active cryptocurrency mining across multiple App Services, I'd recommend opening a Severity A/B Azure Support request immediately and providing:

Defender for Cloud alert IDs

Subscription ID and Resource IDs

UTC timestamps

App Service Plan name and region

Output from Kudu/SSH showing the /diagServer artifacts

Microsoft can verify whether this is expected platform behavior or investigate a potential platform incident. Until then, it's best not to assume a host compromise solely based on the existence of diagnostic binaries.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.