Containing a compromised hypervisor without a rebuild

The situation

The host ran a Windows Server VM that the client used all day over remote desktop. It had also, for some weeks, been running a miner for someone else. Logs had been emptied. A rebuild would have meant days without the VM; the client asked for containment first.

What we did

Inventory before touching anything, and evidence copied off the host. Then each persistence mechanism in turn: a preload library that hid processes from the usual tools, an SSH configuration hook that accepted an attacker's key for every user, an extra management user and an API token, and the miner itself. They were removed in an order that stopped anything respawning. The likely entry, a known login bypass on the management interface exposed to the internet, was closed. Management and remote desktop access were restricted to known addresses, the VM was resized and restarted, and the report listed what was done, what remains open, and why containment was chosen over a rebuild.

What changed

The business kept working through the incident. The open items are tracked, not forgotten, and the host's exposure is now a short list rather than a surprise.