# Have I been hacked?

**URL:** <https://discourse.nodered.org/t/have-i-been-hacked/82408>\
**Category:** General\
**Tags:** security\
**Created:** [27 October 2023 18:46 UTC](https://discourse.nodered.org/t/have-i-been-hacked/82408 "2023-10-27T18:46:57Z")\
**Posts on this page:** 1\
**Showing post:** 37

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [29 October 2023 11:51 UTC](https://discourse.nodered.org/t/have-i-been-hacked/82408/37 "2023-10-29T11:51:19Z")

</div>

Yup!

You have been had, by the same reported here, this suggests you had an unauthenticated Node RED instance being made public?

> [@Node-RED compromise hack](https://discourse.nodered.org/t/node-red-compromise-hack/82257/3):
>
> This is: [TrojanDownloader:Linux/Morila!MTB](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Linux/Morila!MTB) As it has likely run on that system, the system is compromised and likely requires a complete rebuild. Title changed as a hack is confirmed. A strong reminder to all who come across this post: DO NOT EXPOSE YOUR NODE-RED SERVER TO THE INTERNET UNLESS YOU KNOW WHAT YOU ARE DOING It WILL be compromised.

---

_[View the full topic](https://discourse.nodered.org/t/have-i-been-hacked/82408)._