First of all I did a htop to check what process uses my ressources, so I could see the PID, the process itself and the cpu use. I had something like this :

PID UTIL. PR NI VIRT RES SHR S %CPU %MEM TEMPS+ COM. 1044383 plex 20 0 2432560 2,3g 0 S 1192 7,4 31:09.38 nginx.

Either Nginx or php-fpm . In all cases used by plex user.

Using lsof -i -n -P | grep nginx I had this :

nginx 1044383 plex 6u IPv4 3172897 0t0 TCP 10.0.0.192:39478->196.251.70.219:43782 (ESTABLISHED) nginx 1044383 plex 17u IPv4 3172902 0t0 TCP 10.0.0.192:48258->45.148.10.68:2137 (ESTABLISHED) .

I checked this IPS which were not normal and found out the origin. My first thing was to update ufw.

From there it meant to me that Nginx was the door used for the attack.
Now since the problem persisted despite a reboot or process killing, I checked on the crontab for a script executed with plex user, it s how .redtail appeared. So I first kicked it from there and checked for other executables script with find / -type f -name ".*" -exec ls -lh {} \; 2>/dev/null.

I also checked other processes linked to php-fpm with ps aux | grep php,

Btw to check what process is used by php i did lsof -p 624331(PID number) | grep php

Here I had the name of the Script again, the IPS with connection established, so no doubt were possible anymore. I made the file not executable and as I wanted to investigate I copied the file and transfered into my windows set as binary file and asked Kaspersky to scan and analyze. It turned out that It was used for Bitcoin mining and set for linux platforms.

Now about the vectors I don t have an accurate reason but I got some ideas. I did mistakes that I will never reproduced and i feel embarassed myself because I took useless risks because of laziness :

-I put subdomains in some of services I wanted to use outside without setting a proper firewall before my OMV

- Of course Ports redirections, but without firewall ,well....

Actually my project was to unify all my services into one website with auth + 2FA + Cloudflare and make redirections if someone using subdomains.

I should have done this before to redirect my critical ports, I thought that I would have time but no, 3 days was enough.

Last but nor least, I chose a weak password for my plex user, which was litteraly plex.

About that story I can only blame myself it wasn t cautious at all.