today morning I woke up and saw our MongoDB databases are removed and just this DB HOW_TO_RECOVERY_BASE is there. that have a collection which is README and here is content:
{
"_id": {
"$oid": "5e94ba92ab2c988a0e61117e"
},
"content": "All your data is a backed up. You must pay 0.015 BTC to 1DGkm33MMPRzjn2ruDEJeZdBuytBmCwqfZ 48 hours for recover it. After 48 hours expiration we will leaked and exposed all your data. Also do not forget about GDPR. You can buy bitcoin here, does not take much time to buy https://localbitcoins.com with this guide https://localbitcoins.com/guides/how-to-buy-bitcoins After paying write to me in the mail with your DB IP : recovery_bas3@protonmail.com"
}
fortunately, I made a backup last month using rsync command. now I can't find how I can restore my whole server using this backup. and how can I safe my centos VPS and prevent this type of attack?
