Server rebuilt after compromise was re-infected within six hours, exposing persistence mechanism

A marketing website server running a Next.js frontend and Strapi CMS was found infected with a cryptominer, a suspicious systemd-registered binary, and a root crontab that repeatedly recreated a hidden root user and container. The operator contained the machine by cutting its network, preserved a forensic backup, rotated all secrets, and rebuilt the container with hardened settings. Despite this, the server was re-infected about six hours later through the same cron-based persistence pattern, though the attacker was limited to the unprivileged application user. The author reports that the hardening blocked most of the attacker's actions, but the way the attacker still gained access remained unexplained at the time of writing. The author's initial theory was stolen credentials, possibly linked to malware found on an admin workstation.