Exposed Jupyter Notebook: Cryptojacking a Data Server

A Jupyter Notebook server running on a data-science Linux host had its HTTP API left open to the internet on tcp/8888 with no token required. Internet scanners found it within hours; an attacker created a kernel, ran Python cells to execute shell commands, dropped a Monero miner, and beaconed to a stratum pool. Reconstruct the chain from the Linux host logs and the perimeter firewall.