How to deal with malicious kcached processes

If you find something like below on your server, be sure you’ve detected malicious activity

username 2156075 0.0 0.0 2848 2660 ? Ss Feb09 0:00 [kcached]
username 2156076 0.0 0.0 2852 2660 ? S Feb09 0:01 \_ [kcached]

You can use the lsof command to determine which processes have the files open and whether they are being used for legitimate purposes.… Read the rest