Need to find the reason for brute force passwords from my server?

Question

linux

I received a letter from the provider that brute force is going on from my server to other people's subnets. I can't find the reason. There is nothing suspicious in the processes. Autoruns and crontab checked. I checked all the projects on the server, everything seems to be ok. I checked the server with rkhunter. Monitored the network interface via iptraf
The server is monitored via zabbix. Zabbik shows the load load availability up to 2. As soon as I log in via ssh, the load drops. load availability get closer to 0

Answer 1

We need to find the cause of brute force

You don't have to look for anything.
We urgently need to back up the current server (if suddenly there are no backups), raise a new server and set everything up again.

Answer 2

Write the output topto a file. Like this, for example:
top -b -n 5000 > top-5000terations.txt

Answer 3

What protocol/port is used for brute force (provider should say)? You can try blocking this port for outgoing connections.
Perhaps the malware is so smart that when monitoring is turned on, it extinguishes its activity.

Answer 4

If the worm is so cunning and hides during user activity, then make a shell without a tty on an arbitrary port or even backconnect. Plain sh, the worm should not be suspected. top won't work of course, but ps aux is enough.
You can also add a firewall rule to log all new outgoing connections. Monitor the logs with a script that will recognize the UID from the netstat PID, and then already, the name of the program and the line of arguments, and at least the entire process tree, if necessary. But here the main problem is not in the worm, but in how it got to you. And how many backup copies of myself spawned. Without a good knowledge of the system, only reinstallation will help, and that's not a fact, given the hole.
PS The rights to files, chroot and docker were invented for a reason. Insulation makes it easier to solve such problems.