> No I didn't change the password. Instead I rebuilt the machine from the base OS image. Probably not strictly related (it would seem the attack in question wa

> No I didn't change the password. Instead I rebuilt the machine from the base OS image. Probably not strictly related (it would seem the attack in question was via a compromised (on whoever's end) ssh password), but in any case good practice: always regenerate ssh keys after installation from a base image. Some OS images may contain pregenerated keypairs (private key is usually at ~/.ssh/id_rsa ), which should always be regenerated. (This bit is most probably not actually related to the issue at hand, but IAC should not be forgotten.)