Hey friend,

Great question. Every server which is online is under constant attack over SSH when on port 22 (not to imply that changing port is more secure), at the very least. If you had an easy password, they likely slipped right in and planted their malware. It isn’t usually a human doing the work, it’s all automated.

If you just spun up these servers yesterday, I’d suggest you might be able to spare the data on them and just destroy the droplets. If you really need the data off, you’ll need to work with our Trust & Safety team to have them re-enable networking after you’ve booted from our recovery ISO:

https://www.digitalocean.com/docs/droplets/resources/recovery-iso/

Jarland