What Squid said. Your logs are full of thousands of attempts to SSH (and sometimes Telnet) into your server. Looks like it was a successful bruteforce attempt via a botnet.   Also you're right about the container, it's mining Monero.   Not comprehensive and there's probably some better guides out there but just some suggestions based on your situation: Now that you know it's not isolated, make sure you isolate the server from the internet. Whether that takes putting i