Hello to all,
One of our servers was invaded. We just started the investigations, but
the main clue, plus some strange files copied and deleted, is that
sshd binary has changed. Its original size was ~313KB and moved to 1.18Mb. His
version was 3.9p1-11.e4_7. As we at the beginning of investigations, I
wonder if anyone had similar problem, or have any clue on how the
intruder may have entered?
Thanks in advance.
Eduardo Bach