&gt; &quot;So we’ll just delete these files, kill the running process, and be done with it, right?&quot;<p>No, no, no, never! You can poke around the server to figure out how you got attacked, but afterwards the only way to recover is to rebuild from scratch. Someone had root on the system. For all you know, you&#x27;re currently running a recompiled version of kernel&#x2F;init, which will recreate all the original scripts when you&#x27;re not looking.<p>&gt; Lessons Learned<p>I&#x27;d also add: learn about Apparmor &#x2F; Selinux and use them in production. Even if redis was running as root, you could still prevent most of the attack (no file writing, no execution, etc.)