I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of backdoored files was sshd. Ive then analysed the logs and found the host which connected to my server in the first place (using my account password). The same method I've extracted from backdoored sshd worked for accessing the root account of attacking host. I've found significant amount of infected hosts (analysing attacking host's logs). And I've compared the running software. I believe I've isolated the daemon that is vulnerable.
In normal situations I would just format the VM and create a new one (I was using it just for development) but it had the latest stable ubuntu 12.04 linux. (14.04 was released days after I've created the VM) However this seems like a serios vulnerability by the number of infected hosts (and some other sensitive data) and by the fact that my server was running the latest version with all security updates and it still got hacked.
And to get to the question - What should I do next?
(I've got all the snapshots (before infection, after that), access to a lot of infected machines, and an infected server VM part of some kind of botnet that scans and infects other hosts, and some knowledge what other activites it does)
PS: Its not heartbleed as my server's openssl version is : OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014
And the service I believe is vulnerable has no known vulnerabilities.
PPS: How can I check if this is known exploit?