Respond and rebuild
Rebuild from known-good inputs
Replace a compromised server from trusted images, reviewed configuration, patched code, rotated secrets, and verified data instead of cleaning it in place.
8 minute lesson
After privileged compromise, proving every hidden change is gone is difficult. Rebuilding is usually the clearer recovery path.
Create a new host from a supported image, apply reviewed automation, deploy patched artifacts, rotate all reachable credentials, and restore verified data. Compare configuration and expose traffic gradually while monitoring.
Removing the visible backdoor does not prove a root-compromised host is clean. A rebuild costs time, but creates a baseline you can reproduce and review.
Do not copy executables or system configuration from the suspect filesystem. Restore only required data after validation, and keep the old host isolated for the agreed evidence-retention period.
Build a fresh host from the supported image, reviewed configuration, patched artifact, rotated secrets, and verified data. Compare it with the intended manifest, then prove an old credential and an unlisted package are absent.
Lesson completed