Securing a VPS After Long-Term Root Exploitation
The client approached support with what appeared to be a simple request: reset root credentials, restore control panel access, and confirm the website was running correctly. However, deeper checks exposed a far more serious issue. The VPS had been compromised at the highest privilege level, and the intrusion had existed for months.
Bobcares stepped in to restore access, investigate the breach, and recommend a secure path forward that permanently resolves the risk rather than temporarily masking it.
Business Challenge
The VPS had been compromised at root level for months, with hidden scripts, unauthorized processes, and infected backups. Restoring access was urgent, but the deeper challenge was stopping reinfection and securing a safe long-term recovery path.
Technology Used
Blueprint
Bobcares regained administrative access, investigated malicious activity, and confirmed long-standing compromise. A clean VPS rebuild was recommended, migrating only scanned website files and databases while strengthening firewall, SSH, and monitoring controls.
The Client
The organization was operating its website on a VPS powered by CentOS and VestaCP. The server handled web traffic through Nginx and managed databases using MariaDB.
The client believed earlier support work had resolved previous security concerns. When issues resurfaced, confusion followed. They expected the system to be secure and were unsure why problems continued to appear.
The Challenge
The situation quickly revealed multiple concerns:
- A scheduled task was silently downloading and executing a remote script every 30 minutes.
- System commands triggered unexpected outbound network connections.
- Unauthorized services were running in the background.
- File timestamps showed the breach dated back several months.
- Available backups were already compromised.
- The control panel in use was outdated and no longer maintained.
The core issue was not a simple password reset. The entire operating system could no longer be trusted. The objective became clear: regain control, determine the full extent of the breach, and establish a safe long-term recovery strategy without transferring infected data into the rebuilt environment.
Why Bobcares
The client required a team capable of both restoring immediate access and performing a structured security review.
- Recovering locked administrative access through console-level intervention.
- Investigating server activity and identifying hidden malicious behavior.
- Providing clear documentation explaining what happened and when.
- Recommending a practical recovery path based on security best practices.
- Balancing technical resolution with transparent customer communication.
What We Delivered
Bobcares addressed both the urgent issue and the long-term risk.
Rebooted the server through the datacenter console, accessed the system using an emergency account, and securely reset root and control panel credentials. Web services were verified to ensure the site remained operational.
Reviewed scheduled tasks, processes, and network traffic. Found a recurring malicious script and abnormal command behavior. Analysis confirmed the compromise existed since January 30, 2025. Backups were infected, making restoration impossible.
Explained that the breach was not recent but long-standing. Clarified that previous support did not include full malware removal. Shared findings openly to rebuild trust and eliminate confusion.
Advised shifting to a fresh VPS with a clean OS and updated panel. Planned transfer of scanned website files and databases only, excluding system data. Added firewall rules, SSH limits, and monitoring safeguards.
A discounted migration package was provided, including additional setup hours at no extra cost.
The Results
Metric |
Before |
After |
| Backup reliability | Infected | Fresh environment |
| Root access | Restricted and compromised | Fully restored |
| Customer confidence | Concern and uncertainty | Clear direction and trust regained |
| Security visibility | Unclear | Documented and explained |
| System integrity | Long-term breach present | Clean VPS planned |
| Future risk | High chance of reinfection | Controlled and hardened setup |
The Business Impact
- Restored administrative control without downtime.
- Identified and documented a persistent system breach.
- Prevented further damage from recurring malicious scripts.
- Eliminated reliance on infected backups.
- Provided a structured migration plan for lasting stability.
- Improved customer confidence through transparency and goodwill support.
Conclusion
This case demonstrates how a routine support request can uncover a deeper infrastructure failure. When a server is compromised at the root level, superficial fixes are not enough.
Bobcares restored access, uncovered the true extent of the breach, and guided the client toward a clean rebuild. By choosing a fresh VPS instead of attempting partial cleanup, the organization secured its operations and reduced long-term risk.
The result was not just recovery, but a stable foundation built on a system that could once again be trusted.
