This question already has an answer here:
- How do I deal with a compromised server? 2 answers
Last night some one exploit some vulnerability in my site and then upload php script in my images folder .
I have the Amazon EC2 server with centos.
Now the Hacker downloaded 600GB and increased my bill.
Can this be
dos attack. How can i check it.
When hacker was downloading then i see
- CPU usage being 100%
- i saw many apache kworker process running
- i stopped the apache service but data was still being trasmitted
I then stopped my instance
How can i see what happened