My Droplet is compromised and Network Interface disabled

Have you tried force stopping the droplet and turn it back on again? Make sure next time to protect your droplet from malicious people, probably longer it’s down the better. You should read this before you start a new droplet once you’ve gotten access and recovered your files https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication https://www.digitalocean.com/community/tutorials/an-introduction-to-securing-your-linux-vps

Also may I strongly suggest that once you’ve recovered those files you try and check for any back doors that might be hidden in those files since they’re pretty easy to spread.

Heya,

Since you’re already in the Recovery Environment, your filesystem should be mounted under /mnt.

You need to enable networking in the Recovery Environment manually, as outlined in the DigitalOcean Recovery Guide.

You can use the following steps to configure the network:

Run the following command to see available network interfaces:

ip link show

Typically, your network interface will be named something like eth0 or enp3s0.

Create a network configuration file for your interface in the recovery environment. Here’s how to set it up:

sudo nano /etc/network/interfaces

Add the following lines (replace eth0 with the actual name of your interface if it’s different):

auto eth0 iface eth0 inet dhcp

Save and close the file.

Now bring up the interface by running:

sudo ifup eth0

Run the following to check if you have internet connectivity:

ping google.com

If you can ping external servers, your network is working. Now that your network interface is working, you should be able to connect to your droplet using SFTP or SSH.

If you need to remove compromised files, navigate to /mnt/ where your filesystem is mounted. You can use SSH/SFTP to manually delete the files or back them up to your local machine.

Hope that this helps!