How to reflect a hacker attack on the server (hosting)?

Question

Information Security

I really need help. Immediately, I note that I do not own the subject area. The other day, all sites on the hosting (vps server) were hacked and mass mailings were made, as a result, all sites were filled up. Technical support pointed to suspicious files, we deleted them and rolled back all sites to last year's version. We changed passwords, denied access to all IPs, except for workers, in .htaccess. At night, one of the sites gave a 403 error, after which this appeared on the sites . What measures can be taken independently / together with technical support, or can one not do without the services of a specialist?

Answer 1

It looks like hacking the OS itself on a VPS. You are concentrating on sites - perhaps you are looking in the wrong place.
Update your OS (by the way, which one do you have?). If it is possible to stop the server for a while and have all the backups, then it may be better (and faster) to install a fresh OS from a clean image from the offsite, and then raise the backups.
In general, you need a competent administrator, not a site specialist, but an OS administrator who understands system security. He may not have to be hired permanently, but simply given one-time work on installing the OS, setting up security, uploading and raising sites. But don't skimp on it too much, you don't want to see that green flag again in a couple of weeks.

Answer 2

Change host. Maybe the problem is not yours.

Answer 3

Update everything that can be updated (os, apache, nginx, php, cms, cms plugins) + How to protect sites from hacking?
Move cms admins to non-standard url addresses and close them via www.softtime.ru/info/apache.php?id_article=27
Prohibit execution of php code in directories where there should be no php code at all, especially if user files can be uploaded into it.
Prevent the user from which the web server is running from writing and reading directories that he should not touch.

Answer 4

just look at the logs of how you were hacked and close the hole

Answer 5

proftpd installed? What version?
UPD: as expected, this is CVE-2015-3306 ( habrahabr.ru/post/257027/)

Answer 6

Thanks everyone for the replies and recommendations! The viruses were removed, according to the logs it was determined that the hack was made through holes in the joomla. The mod_copy module has been disabled.