Dear Antoine, You can simply block inbound connections on your virtual router public ip's by any external firewall,And accept just outbond connections. BR Ahmed
On Tue, Apr 5, 2022 at 10:46 PM Antoine Boucher <antoi...@haltondc.com> wrote: > Someone has externally gained access to one of our VR vm and installed an > application that tried to ssh to other ips on the web. > > The VR started to miss health checks about a day ago, looking at the VR > running process we discovered that the process ksoftirqd was 95% busy. We > killed the VR and discovered during our investigation from other systems > that the vm was blasting the web trying to connect on port 22. > Unfortunately, the vr has been deleted. > > What could have happened? Any known security issues on the 4.16.1.0 vr > template? > > Regards, > Antoine
