DiHubMT — Maltese Startup Hub

The day before the conference, we were invited by organizers to visit the local startup hub DiHubMT — where they held a presentation and gave us a tour of their office.

The hub offers office spaces to its members, meeting points, conference halls, rooms to record podcasts and interviews, its own mini-data center, and much more to help create successful tech products.

We learned about their offering and exchanged contacts, noting that their machine learning and data center services may be useful to us while working with medical and user data.

Malta Enterprise — helping startups to grow

Next, we met representatives of the Malta Enterprise agency, created and supported by the Malta government. We met them at DiHubMT. We had already heard about them from our friends at another Belarusian startup, who told us that Malta Enterprise helped them relocate their business, providing financial and legal support.

Malta Enterprise offers a wide range of interactions and services, the main goal of which is attracting and legalizing businesses and startups in Malta. Actually, the conference itself is a bright example of the government’s support to grow and scale the technology ecosystem.

Such support is very interesting to us, so we also exchanged contacts and scheduled a meeting to learn more about possible formats of collaboration.

Gero Sense — technologies to protect longevity

Another interesting acquaintance was the Gero Sense team — a product dedicated to analyzing data from phone sensors (like steps or heartbeats) and calculating age indicators of a person.

We were surprised because this is not the only domain they are working in: they have projects in pharmacology and longevity research. We liked their scientific approach and how they position themselves among their colleagues.

During the conversation, they offered us a partnership, which includes access to their AI models. This gives us the ability to provide our users with relevant information about their health status.

Sexual Health Malta — sexual health and education

Beyond startup growth, the government actively supports different health initiatives. Sexual Health Malta is an example of the government’s educational program directed at popularizing knowledge about sex, hygiene, and infections.

With them, we discussed that we have experience building research platforms (similar to our partnership with Tor Vergata University) and educational libraries.

MedTech Innovator — health-tech accelerator

The last important contact was MedTech Innovator — the largest health-tech accelerator. A partnership with them may help us grow our connections and expertise in building health-tech startups.

In conclusion

After MedTech Malta, at Sequoia: Men’s Health we understood that highly specialized events are more beneficial than large conferences: the percentage of potentially valuable contacts is higher, and the number of random attendees is significantly lower.

The conference and new connections gave us rich food for thought about what we can do now, what is better for our users, how to implement it and deliver it to the user, and, most importantly, how significant are the results of our work?

The concept of a “miner” has become one of the most common attack vectors on user devices in the modern world. The ease of mining cryptocurrencies like Monero has allowed attackers to exploit web browsers as a target.

Attackers are also rapidly infecting cloud infrastructure. Poor digital hygiene and vulnerabilities in both open‑source and proprietary tools create fertile ground for the abuse of computing resources.

Metabase and product analytics

For every startup, including Sequoia, it is important to understand what happens inside the product: which features are most popular, how users behave, what actions they perform, and what helps retain the audience.

In the early stages, it is common to use third‑party tools like Firebase Analytics, Amplitude, Yandex AppMetrica, and others.

However, for tasks requiring direct access to the primary database, these tools are not suitable. Often, startups use open‑source or self‑hosted solutions. One of the well‑known, popular, and flexible tools is Metabase.

For Sequoia, it proved that we can build any dashboards and charts that were impossible to create with third‑party cloud services.

Miner detection

Infrastructure monitoring is a critical part of DevOps culture. When processes are built correctly and competently, it becomes normal to quickly detect and prevent threats.

During our weekly review, we noticed that one of the Docker machines started consuming abnormally high amounts of CPU and RAM.

The first step was to analyze the processes by CPU consumption to determine which one was out of the norm.

We detected the process kdevtmpfsi. A quick search shows that it is a well‑known malware miner.

The source of the problem

After removing the miner and its files and blocking outgoing ports, we needed to determine how it got into the system. Initially, our cloud infrastructure blocked access to the machine (except HTTP(S) and SSH).

To understand who actually initiated this process, it is necessary to consult the process tree, which reveals the initiator behind the launch of a specific program — whether it be the system, a user, or another program.

Analysis of the process tree revealed that the miner was not located on the host machine but inside an active Docker container.

The next step was to identify the Docker image the miner was running in. To do this, we examined the path to the executable file.

It turned out that the miner was running inside a Metabase container — the product analytics tool we use at Sequoia.

Reason for appearance

The self‑hosted version of Metabase installed on Sequoia’s servers contained a vulnerability that allowed an attacker to connect to the machine and execute arbitrary commands. The miner was installed through this vulnerability.

A detailed analysis of the vulnerability was published on the Metabase blog: https://www.metabase.com/blog/vulnerability-post-mortem

Consequences

In Sequoia’s case, user data was not affected. However, the infrastructure was disrupted for several days, resulting in decreased API response time.

We updated self‑hosted tools, changed infrastructure configuration, and reviewed security policies — all without harming user experience or data.

Tips for the Future

I would advise our readers to pay closer attention to the frequency and tools used for their security audits. Review all dependencies and reduce their number to minimize their impact on your infrastructure. And always isolate user data to minimize both technological and reputational risks.