I fell behind a few weeks on security updates and missed an update on a container image that had a security patch. Someone installed XMRig into that container and started mining crypto from it.