Hello to all,

One of our servers was invaded. We just started the investigations, but the main clue, plus some strange files copied and deleted, is that sshd binary has changed. Its original size was ~313KB and moved to 1.18Mb. His version was 3.9p1-11.e4_7. As we at the beginning of investigations, I wonder if anyone had similar problem, or have any clue on how the intruder may have entered?
Thanks in advance.

Eduardo Bach