Not sure if this should go under security or Ubuntu but, I believe that my server got hacked somehow. Its being hosted on Digital Ocean and I mainly use it fiddle around with things. Today, I got a notification from NewRelic that my sever has surpassed 90% disk usage. Logging in, I run a normal df -h to find this:
Filesystem Size Used Avail Use% Mounted on
184.108.40.206:/public/home2 917G 826G 46G 95% /var/tmp/temp
I find that odd because I haven't mounted anything recently, yet alone touched the server in a couple months. I can view all files in the share but nothing seems to be useful. Just a bunch of binaries and tars in folders. The IP seems to be from China. I got the notification today, so I checked fstab and history of accounts created on the server. I don't see anything fishy but, I'm starting to think that I got hacked. I know this is possible but how? Has anyone ever seen anything like this? Is there anything I can do further to prevent this?
Server details: Root account disabled, ssh port changed, I'm the only user with access and haven't been logged on in months. This had to have happened today because I got the NewRelic notice this morning.