The hardest situation to handle well.
IMMEDIATE ACTIONS
- Isolate the server. Restrict network access, or take it offline if it is actively harming others.
- Do not reboot immediately; it destroys evidence in memory and may not remove persistence.
- Preserve logs by copying them off the server.
- Open a ticket with us.
ASSESS
What was accessed, what was changed, and how entry was gained. Check authentication logs, file modification times, cron jobs, user accounts and listening ports.
THE HARD TRUTH
A thoroughly compromised server cannot be reliably cleaned. An attacker with root access can hide persistence in ways that are impractical to find.
The reliable recovery is to rebuild: a fresh server, applications reinstalled from known-good sources, data restored from a backup predating the compromise, and every credential rotated.
REBUILDING
- New server, secured before anything is put on it.
- Reinstall applications from official sources, not from the compromised server.
- Restore data, checked for anything malicious.
- Rotate every credential: SSH keys, database passwords, application accounts, API keys.
- Close the entry point before going live.
AFTERWARDS
Write down what happened and what you changed.
