>>/957877/
It was hackers, got in through the open port anc C2's the server.