# Server hacked? We find what is hiding.

Source: https://vetosec.at/en/servers/rootkit-analyse/

Good attackers hide. The server then only shows what they allow. We look deeper and tell you: clean, hacked or rebuild.

- **Down to the core** of the system
- **Evidence** secured
- **Clear answer** in the report

## What you get

- **A clear answer**: Clean or hacked, with reasons. You know what to do next.
- **What else is affected**: Which passwords and systems the attacker could have reached.
- **Evidence for insurer and authorities**: We secure first. That keeps the evidence usable.
- [**Secure afterwards**](https://vetosec.at/en/servers/linux-haertung/): If you want, we rebuild the server clean and hardened.

## Where attackers hide

A virus scanner asks the server itself. A good attacker fakes exactly that answer.

- **In the system core**: A module slipped into the kernel. The server then hides programs, files and connections.
- **In the tracing tools**: Newer attacks use the tools developers use to watch the system. From outside everything looks normal.
- **In swapped programs**: A fake login program records passwords. It looks like the original.
- **In the reboot**: Hidden entries make sure the attacker is back after every reboot.

## Process

1. **Secure**: Secure memory and disks before anyone reboots.
2. **Check deep**: Ask the system core directly and compare the answers.
3. **Check programs**: Compare every program with the clean original.
4. **Cross-check from outside**: What the firewall sees against what the server says.
5. **Report**: Result, timeline, next steps.

## Acute suspicion

**Do not reboot. Unplug the network and call.**

A reboot often wipes the only evidence. Leave the server running.

## Scope

**One server or all of them. With a report at the end.**

Billed by effort. In an emergency we start right away.

Send a request

## For IT leads

Technical details: ftrace · kprobes · perf · eBPF · bpftool · bpftrace · auditd · rpm -Va

- **Acquisition**: Image of memory and disks before any change, checksums and chain-of-custody log.
- **Kernel**: Comparison of /proc/modules, /sys/module and kallsyms, taint flags, module signatures.
- **Tracing**: Check of enabled_functions and registered kprobes for foreign hooks, analysis with ftrace and perf.
- **eBPF**: Inventory of loaded programs and maps with bpftool, search for programs attached to syscalls and tracepoints.
- **Userland**: rpm -Va with static tools from clean media, ld.so.preload, PAM modules, SUID files.
- **Persistence**: systemd units and timers, cron, udev rules, initramfs, authorised SSH keys.
- **Network**: Comparison of firewall and flow data with the connections the server reports, external scan.

## Further reading

- [**PHP2Shell: Was Website-Betreiber jetzt tun müssen**](https://vetosec.at/en/articles/cybersecurity/php2shell-was-website-betreiber-jetzt-tun-muessen/): Two critical PHP flaws are being exploited since October 2026.
- [**Got Hacked? Immediate Steps for Austrian Businesses**](https://vetosec.at/en/articles/cybersecurity/gehackt-worden-sofortmassnahmen-fur-osterreichische-unternehmen/): The first hours matter: isolate systems, preserve evidence and stabilise operations methodically.
- [**KI findet Sicherheitslücken am Fließband: Was das für Ihre Server heißt**](https://vetosec.at/en/articles/cybersecurity/ki-findet-sicherheitsluecken/): New AI models find vulnerabilities faster than ever.

## Frequently asked questions

### Is a virus scanner enough?

No. It asks the server itself, and that is exactly the answer a good attacker fakes. We also check from inside and outside.

### Should we reboot?

No. Disconnect the network, leave the server on, call us.

### Do you check Windows too?

This analysis is for Linux. For Windows our IT emergency service helps.

### Who is this for?

For companies with about 30+ staff and anyone whose servers must not stop. With or without an in-house IT team.

## Related

- [IT emergency](https://vetosec.at/it-notfall/): for companies
- [IT Check](https://vetosec.at/en/services/it-check/): from €1,299
- [Monitoring & SIEM](https://vetosec.at/en/services/monitoring/): part of operations

## Detecting rootkits and checking hacked Linux servers in Austria

vetosec examines suspicious Linux servers for LKM, eBPF and ftrace rootkits, tampered binaries and persistence, with evidence capture and a report.

Updated: October 26, 2026

Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/