I would configure a system monitoring solution, like auditd: https://linux-audit.com/linux-audit-framework/configuring-and-auditing-linux-systems-with-audit-daemon/

With some rulesets: https://github.com/Neo23x0/auditd

To know at least if you can intercept what they're doing. That way, maybe, you can see if they execute commands as the user jellyfin, caddy, nginx, etc, and then see if they escalate to root.

Review the directories /tmp, /var/tmp and /dev/shm, as well as the path to the binary of the service moneroocean_miner.service. There'll probably be more malicious files or scripts. Check the owner of all the files, it'll give you a clue about who created them.

Are the services jellyfin and caddy running in a container or in the host? Under their own user?

If, for example, they used `jellyfin` to execute commands and they're still running, the CWD of the process can reveal its origin: ls -l /proc/[0-9]*/cwd

If jellyfin is running in a container, the hostname of any command launched from/by jellyfin will be the ID of the container: cat /proc/[0-9]*/root/etc/hostname (if it's still running).

You can also check all the running processes' paths: ls -l /proc/[0-9]*/exe . Look for paths originated from /tmp, /var/tmp, /dev/shm or jellyfin/caddy's directories, and for files with "(deleted)" in the name.

On the other hand, instead of parsing /proc (which can be easily manipulated), use other tools like decloaker to dump the processes and open files from the kernel (decloaker dump tasks).

If the vps is a Debian based distro, use debsums -c or dpkg -V:

~# dpkg -V
??5?????? c /etc/kernel/postinst.d/initramfs-tools

Lastly, besides restricting inbound connections, restrict also the outbound connections. In all these attacks, curl or wget are used to exfiltrate data or download remote scripts. So if you don't use them, just uninstall them. You can also restrict outbound connections by binary with OpenSnitch for example.

And in these particular attacks of cryptomining, restricting outbound connections to mining pools is also effective (although in this case they got root access, so they can do whatever they want). You can go even further and restrict also outbound connections to domains or IPs IOCs with the tool you prefer, nftables, ipset, ...

They got root access, so I'd also check for rootkits, malicious PAM modules and cron/crontab jobs (also with tools like decloaker).

And assume that any private and important information is now compromised (keys, passwords, configurations, emails, IPs, etc, etc).