How to Recover a Hacked Linux Server

A hacked server requires immediate, systematic action. This guide walks through the complete incident response process from detection to full recovery.

Step 1 — Isolate Immediately

# Take server offline from public traffic
# In Cloudflare: enable Under Attack mode
# Or block all traffic at firewall level
sudo ufw default deny incoming
sudo ufw allow from YOUR_IP to any port 22

Step 2 — Identify the Breach

# Check recently modified files
find /var/www -name "*.php" -newer /tmp -mtime -7 2>/dev/null

# Check for base64 encoded malware
grep -r "base64_decode\|eval(base64\|gzinflate\|str_rot13" /var/www --include="*.php" -l

# Check running processes
ps aux | grep -v "www-data\|root\|mysql" | head -20

# Check network connections
netstat -tulpn | grep LISTEN
ss -tulpn

Step 3 — Check Auth Logs

# Successful logins
grep "Accepted" /var/log/auth.log | tail -30

# Failed attempts
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -20

# Check for new user accounts
cat /etc/passwd | grep -v "nologin\|false" | awk -F: '$3 >= 1000'

Step 4 — Remove Malware

# Scan with ClamAV
clamscan -r /var/www --infected --remove --log=/tmp/clam-scan.log

# Find and remove webshells
find /var/www -name "*.php" -exec grep -l "system\|exec\|shell_exec\|passthru" {} \; | xargs ls -la

# Check crontabs for malicious entries
crontab -l
sudo crontab -l
for user in $(cut -f1 -d: /etc/passwd); do sudo crontab -u $user -l 2>/dev/null; done

Step 5 — Restore from Clean Backup

# Restore files from last known good backup
# Do NOT restore the hacked files
restic restore --target /var/www/restore/ --host yourserver

# Restore database if compromised
mysql -u root -p dbname < clean-backup.sql

Step 6 — Rotate All Credentials

# Change all passwords immediately:
# - SSH keys (revoke and regenerate)
# - MySQL root and app passwords
# - WordPress admin passwords
# - Control panel passwords
# - API keys and tokens
wp user update admin --user_pass=$(openssl rand -base64 24)

Conclusion

Server compromise requires immediate expert response. Our team provides emergency malware removal and server recovery services.