ADAM PULSE Knowledge Base
Cybersecurity · Incident Response · Post-Breach

What happens after a hacker gets into your server?

By Michael Obraitis, Managing Partner, and Michael Dale, CEO·Published August 12, 2026·Last reviewed August 2026·ADAM Pulse Knowledge Base

The short answer: Gaining access is often only the beginning.

Once an attacker gets into a server, the next objective may be to make that access durable, increase privileges, weaken defenses, collect credentials, discover other systems, move deeper into the environment, or prepare the system for another purpose.

That is why a successful login should never be viewed as the entire incident.

> Getting into the network is not necessarily the attacker's objective. It is often just the beginning of the attack.

And there is an equally important recovery lesson:

> Restoring service does not prove the attacker is gone.

A compromised server can be online, responding to users, and apparently functioning normally while an attacker has already created another method of access.

What Do Hackers Do After They Gain Access to a Server?

There is no single sequence followed by every attacker.

What happens next depends on the attacker's objective, privileges, target, automation, and opportunity.

Possible actions include:

The key concept is that initial access and attacker objectives are not the same thing.

What Is Persistence in Cybersecurity?

Persistence is the ability of an attacker to maintain access to a compromised environment despite interruptions such as password changes, reboots, or other defensive actions.

MITRE ATT&CK documents numerous persistence techniques used by adversaries, including account manipulation and modification of authentication mechanisms.

Persistence matters because an attacker may anticipate that defenders will eventually discover the original intrusion.

The attacker therefore wants another door.

Think of it this way:

Initial compromise

↓

Attacker gets inside

↓

Attacker creates another access method

↓

Original vulnerability is fixed

↓

Attacker still has access

That is persistence.

Source: MITRE ATT&CK, Enterprise Persistence and Account Manipulation https://attack.mitre.org/tactics/TA0003/ https://attack.mitre.org/techniques/T1098/

Why Would an Attacker Replace SSH Keys?

SSH is commonly used to remotely administer Linux, Unix like systems, network devices, hypervisors, and other infrastructure.

SSH can authenticate users with cryptographic keys.

A server may contain an `authorized_keys` file identifying public keys permitted to log into a particular account.

MITRE ATT&CK specifically documents SSH Authorized Keys as a persistence technique. An adversary who can modify the authorized keys file may add an attacker controlled key and use it to maintain access.

That is exactly why the behavior described in the honeypot story is so important.

The attacker did not simply log in.

The attacker reportedly:

  1. Removed existing keys
  2. Added an attacker controlled key
  3. Changed the root password

Those actions suggest an attempt to change who controls future access.

Source: MITRE ATT&CK, Account Manipulation: SSH Authorized Keys https://attack.mitre.org/techniques/T1098/004/

What Is an SSH Key?

An SSH key pair generally consists of:

Private key

and

Public key

The private key is kept by the authorized user.

The public key can be placed on a server.

When configured correctly, the server can verify that the connecting user possesses the corresponding private key.

This can provide strong authentication without requiring a traditional password for every SSH session.

But the security depends on protecting the keys and controlling which public keys are authorized.

Can an Attacker Add Their Own SSH Key?

Yes, if the attacker obtains sufficient access to modify the relevant configuration or authorized keys.

MITRE ATT&CK identifies modification of SSH `authorized_keys` as a technique adversaries may use to maintain persistence on victim hosts.

That means changing the user's password may not remove the attacker's access if an unauthorized key remains authorized.

This creates an extremely important incident response principle:

> Changing the password may close one door while leaving another door open.

Source: MITRE ATT&CK, T1098.004 SSH Authorized Keys https://attack.mitre.org/techniques/T1098/004/

Why Would an Attacker Delete the Existing SSH Keys?

Potential reasons could include:

The exact motive cannot be determined from the action alone.

But unauthorized modification of authentication material should be treated as serious evidence of compromise.

Why Would a Hacker Change the Root Password?

On many Unix like systems, root represents the highest privileged administrative account.

If an attacker controls root level access, they may be able to make extensive changes to the system.

Changing the root password could:

MITRE ATT&CK notes that adversaries may manipulate accounts, credentials, and permissions to maintain or elevate access.

Source: MITRE ATT&CK, Account Manipulation https://attack.mitre.org/techniques/T1098/

What Is Privilege Escalation?

Privilege escalation occurs when an attacker obtains greater permissions than they initially had.

For example:

Initial access: Limited user account

↓

Privilege escalation: Administrator or root

Why does this matter?

Because higher privileges can provide access to:

MITRE ATT&CK maintains an entire Privilege Escalation tactic covering techniques adversaries may use to obtain higher level permissions.

Source: MITRE ATT&CK, Privilege Escalation https://attack.mitre.org/tactics/TA0004/

Does Every Attacker Need Privilege Escalation?

No.

An attacker may already compromise a privileged account.

Or the access they initially obtain may already be sufficient for their objective.

For example, a compromised application account might already have access to valuable data.

Cybersecurity teams should therefore avoid assuming:

No administrator access means no serious compromise.

The relevant question is:

What could the compromised identity actually do?

What Is a Backdoor?

A backdoor is an unauthorized mechanism that allows access while bypassing or circumventing the expected access path.

The term can describe different techniques.

A backdoor might involve:

The purpose is often the same:

Make returning easier.

Is an Added SSH Key a Backdoor?

In an unauthorized context, an attacker controlled SSH key can function as a persistence mechanism that provides continued remote access.

The important distinction is authorization.

SSH keys themselves are legitimate security technology.

The malicious behavior is the unauthorized addition or manipulation of them.

This is a recurring cybersecurity pattern:

> Attackers frequently abuse legitimate administrative capabilities rather than inventing entirely new ones.

Why Is Legitimate Tool Abuse Difficult to Detect?

Because the action may resemble normal administration.

Administrators legitimately:

Attackers may do the same things.

The difference is:

authorization

and

context.

That is why logs, baselines, identity information, change records, and monitoring matter.

What Is Defense Evasion?

Defense evasion describes actions attackers take to avoid detection or interfere with security controls.

Examples may include:

MITRE ATT&CK documents numerous techniques associated with defense evasion and defense impairment.

If an attacker disables a security script or removes blocked addresses, the concern is not merely the individual configuration change.

The concern is that the attacker may be deliberately weakening the environment to make additional activity easier.

Why Do Attackers Disable Antivirus or Security Tools?

Because security controls can:

Detect them

Block them

Quarantine malware

Record their activity

Notify defenders

An attacker who can impair those controls may increase the time available to operate.

That is why security tool failures themselves can be security signals.

If endpoint protection unexpectedly stops, a logging agent disappears, or a firewall rule changes without authorization, the organization should investigate why.

What Does “Impair Defenses” Mean?

It means interfering with technology or configurations intended to protect or observe the environment.

The goal may be to:

Security monitoring should therefore include the health of the security tools themselves.

A monitoring platform that is no longer reporting is not necessarily evidence that everything is quiet.

Sometimes the absence of data is itself the event.

Why Would an Attacker Delete Blocked IP Addresses?

A blocked address list may prevent known hostile systems from connecting.

Removing entries could restore access for previously blocked infrastructure.

But defenders should avoid relying on IP blocklists as their only defense.

Attack infrastructure changes.

Botnets use many systems.

Cloud addresses can be reassigned.

VPNs and proxies can obscure origin.

Blocking known hostile addresses is useful, but it belongs inside a broader security strategy.

What Happens After Persistence?

An attacker may begin exploring.

This is often called discovery.

The attacker may want to understand:

Where am I?

What system is this?

What privileges do I have?

What other systems exist?

What credentials are available?

What data is valuable?

Can I reach something more important?

Discovery helps the attacker decide what to do next.

Why Would an Attacker Check the Hardware?

The honeypot transcript described an attacker checking processors and graphics hardware.

That can reveal what the system might be useful for.

Potential attacker interests may include:

The important lesson is that attackers may evaluate compromised systems as resources.

> Your server may be valuable even when the attacker does not care about your files.

Why Would a Hacker Check Whether the System Is a Router or Camera?

Because different devices offer different opportunities.

A router may provide:

A camera may provide:

An attacker may automatically fingerprint the device before deciding what payload or command sequence to use.

This is another reason internet connected devices need security lifecycle management.

What Is Lateral Movement?

Lateral movement occurs when an attacker uses access to one system to reach another system or resource.

Imagine:

Compromised web server

↓

Credential discovered

↓

Internal server accessed

↓

Administrator credential obtained

↓

Additional systems reached

The first compromised machine becomes a stepping stone.

MITRE ATT&CK documents lateral movement as a major adversary tactic.

Source: MITRE ATT&CK, Lateral Movement https://attack.mitre.org/tactics/TA0008/

Why Is Network Segmentation Important After a Compromise?

Segmentation can limit what a compromised system can reach.

Compare two environments.

Flat Network

One compromised system can communicate broadly with many other devices.

Segmented Network

Communication between systems and security zones is restricted according to business need.

Segmentation does not make compromise impossible.

It can reduce the attacker's freedom of movement.

What Is Credential Dumping?

Credential dumping refers to techniques used to obtain authentication material from operating systems or applications.

Depending on the environment, attackers may seek:

The objective is often to turn access to one system into access to additional identities or systems.

This is why privileged credentials should not be unnecessarily exposed across large numbers of devices.

Why Are Administrator Credentials Especially Valuable?

An administrator credential may provide broader access than a normal user account.

If the same privileged credential is reused across many systems, one compromise can have much greater consequences.

Organizations should use privileged access practices that limit unnecessary credential reuse and administrative reach.

Least privilege matters not only for users.

It matters for administrators too.

What Is Command and Control?

Command and control, often abbreviated C2 or C&C, describes communication between compromised systems and attacker controlled infrastructure.

The attacker may use that communication to:

A compromised server may therefore communicate outward even if the original attack came from somewhere else.

Outbound monitoring can matter just as much as inbound protection.

Why Would an Attacker Download a File After Getting In?

The initial access method may only provide a foothold.

The attacker may then download:

The downloaded file may support the next phase of the attack.

This is why incident responders need to understand not only:

How did they get in?

but also:

What did they do after they got in?

What Is a Web Shell?

A web shell is malicious code placed on a web server that can allow an attacker to issue commands or maintain remote access through the web application environment.

Web shells are particularly concerning because fixing the vulnerability used for initial access may not remove the malicious file already placed on the server.

Again:

Initial access fixed

does not automatically mean

attacker removed.

What Is a Scheduled Task or Cron Persistence Mechanism?

Operating systems provide legitimate mechanisms for running tasks automatically.

Windows has scheduled tasks.

Unix like systems commonly use cron and other service mechanisms.

Attackers may abuse legitimate scheduling functionality to execute malicious commands or restart malicious tools.

A reboot therefore may not remove the problem.

The malicious process may simply start again.

Does Rebooting a Compromised Server Remove the Hacker?

Not necessarily.

A reboot may stop some temporary processes.

But persistent mechanisms may survive.

Examples could include:

A reboot is an operational action.

It is not a complete incident response strategy.

Does Changing the Password Remove the Hacker?

Not necessarily.

Changing passwords can be an important response step, but attackers may have:

This is why incident response requires eradication rather than a single corrective action.

What Is Containment?

Containment is the process of limiting the incident so additional damage or spread can be reduced.

Depending on the situation, containment could involve:

The appropriate action depends on the incident.

NIST's current incident response guidance places containment within a broader response and recovery process.

https://csrc.nist.gov/pubs/sp/800/61/r3/final

What Is Eradication?

Eradication focuses on eliminating the incident's effects and the attacker's continued foothold.

NIST SP 800-61 Revision 3 specifically notes that eradication may require eliminating persistence mechanisms and entry points, including deleting malware, disabling breached accounts, and identifying and mitigating exploited vulnerabilities.

That is the critical distinction.

Containment asks:

How do we stop this from getting worse right now?

Eradication asks:

How do we remove the attacker's ability to remain or return?

https://csrc.nist.gov/pubs/sp/800/61/r3/final

What Is Recovery?

Recovery is the process of restoring systems and operations to an acceptable state after the incident has been contained and addressed.

That can include:

Recovery should not be confused with simply turning the server back on.

Containment vs. Eradication vs. Recovery

These terms are important.

Containment

Limit the incident.

Eradication

Remove the attacker's foothold, persistence, and exploited weaknesses.

Recovery

Restore trusted operations and monitor the environment.

NIST SP 800-171 Revision 3 requires an incident-handling capability covering preparation, detection and analysis, containment, eradication, and recovery (control 03.06.01, Incident Handling).

https://csrc.nist.gov/pubs/sp/800/171/r3/final

Why “The Server Is Back Online” Is Not Enough

Imagine:

Server compromised

↓

Administrator changes password

↓

Server rebooted

↓

Website works

Management says:

Fixed.

But the attacker had already added:

another SSH key

or

another account

or

another persistence mechanism.

The business service recovered.

The security incident did not.

> Availability is not the same as integrity.

A system can be available and still not be trustworthy.

What Does It Mean to Trust a Server Again?

Trust requires confidence that:

For serious compromises, organizations may decide that rebuilding from known good sources provides greater assurance than trying to manually reverse every attacker change.

The appropriate response depends on the incident and environment.

Should You Rebuild a Compromised Server?

Sometimes rebuilding is the safest approach.

If an attacker obtained extensive privileged access, it can be difficult to prove that every unauthorized modification has been found.

A rebuild can involve:

The decision should be made by qualified incident response personnel based on the scope and severity of compromise.

Why Backups Alone Do Not Solve This Problem

A backup may contain:

Restoring yesterday's server does not help if yesterday's server was already compromised.

Recovery therefore needs to answer:

When did the compromise begin?

and

What state can we trust?

Why Logs Matter After a Compromise

Logs help reconstruct what happened.

Useful questions include:

When did the attacker first connect?

Which account was used?

What commands were executed?

Which files changed?

Were accounts created?

Were SSH keys modified?

Did the attacker connect elsewhere?

What outbound connections occurred?

Were security controls disabled?

Was data accessed or transferred?

Without logs, incident investigation becomes much more difficult.

Why Centralized Logging Matters

If logs exist only on the compromised server, an attacker with sufficient privileges may modify or delete them.

Centralized or remote logging can preserve additional evidence outside the compromised host.

This creates another useful principle:

> Do not make the system being investigated the only keeper of the evidence.

What Is an Indicator of Compromise?

An indicator of compromise, commonly called an IOC, is evidence that may suggest malicious activity.

Examples can include:

IOCs can be valuable, but they should not be the only detection method.

Attackers can change infrastructure and files.

Behavioral context matters too.

What Is a File Hash?

A file hash is a value calculated from a file's contents.

It can act like a digital fingerprint.

Security teams can compare a suspicious file's hash with threat intelligence and malware analysis databases.

But hashes have limitations.

A small change to a file can produce a different hash.

Therefore:

Hash not recognized

does not mean

file is safe.

What Is an Indicator of Attack?

Defenders increasingly distinguish between static indicators and attacker behaviors.

For example:

Known malicious IP address is an indicator.

But:

Unauthorized addition of an SSH key followed by a privileged remote login describes behavior.

Behavior can remain suspicious even if the attacker changes IP addresses or file hashes.

That is one reason frameworks such as MITRE ATT&CK are useful.

They describe what adversaries do.

How Do You Know If an Attacker Is Still in the Network?

There is no single universal test.

Investigation may examine:

The broader question is not merely:

Can we see the attacker right now?

It is:

Have we identified and removed every known path they could use to return?

Why Credential Rotation Must Be Planned Carefully

If attackers may have stolen credentials, organizations may need to rotate affected passwords, keys, tokens, certificates, and secrets.

But sequence matters.

If credentials are changed while the attacker still controls a system that can capture the new credentials, the attacker may simply obtain them again.

Incident response should therefore coordinate:

Containment

credential rotation

eradication

recovery

rather than treating each as an isolated checklist item.

What Should You Do If You Think a Server Is Compromised?

The exact response depends on the environment and severity, but businesses should have a documented incident response process.

Potential steps include:

  1. Escalate to the appropriate security or incident response personnel.
  2. Preserve relevant evidence.
  3. Determine the scope of affected systems and accounts.
  4. Contain the incident.
  5. Identify the initial access method.
  6. Identify persistence mechanisms.
  7. Address compromised credentials.
  8. Remove malware and unauthorized access.
  9. Patch or mitigate exploited vulnerabilities.
  10. Validate system integrity.
  11. Recover business services.
  12. Increase monitoring for recurrence.
  13. Document lessons learned and corrective actions.

For significant incidents, engage qualified cybersecurity incident response professionals and follow applicable legal, contractual, regulatory, insurance, and reporting requirements.

Should You Immediately Turn Off a Compromised Server?

Not always.

Disconnecting or shutting down a system can reduce ongoing harm, but it may also affect:

Containment decisions should follow the organization's incident response procedures and be made with qualified security personnel where possible.

The correct response depends on the situation.

Why Incident Response Needs a Plan Before the Incident

During an active compromise is a bad time to begin asking:

Who has authority to disconnect the server?

Who calls legal?

Who contacts the customer?

Who has the backups?

Who can reset privileged credentials?

Who contacts the cyber insurer?

Who handles communications?

Preparation reduces decision making under pressure.

NIST SP 800-61 Revision 3 emphasizes integrating incident response into broader cybersecurity risk management so organizations can improve preparation, response, and recovery.

https://csrc.nist.gov/pubs/sp/800/61/r3/final

Where USA Telecom and ADAM Fit

USA Telecom and ADAM are not replacements for digital forensics, endpoint detection and response, SIEM platforms, malware analysis, identity security, or professional incident response services.

Their value can sit in the operational visibility surrounding an incident.

Questions may include:

Which locations are unreachable?

Which devices stopped responding?

When did connectivity change?

Did a firewall reboot unexpectedly?

Did VPN connectivity disappear?

Did a circuit fail over?

Did service recover after containment?

Which systems remain abnormal after remediation?

This operational context can help technical teams understand the business impact of security events.

Security Monitoring and Operational Monitoring Should Work Together

Security monitoring may say:

Unauthorized administrator activity detected.

Operational monitoring may say:

Branch firewall became unreachable three minutes later.

Ticketing may say:

No approved maintenance existed.

Identity monitoring may say:

Login originated from an unusual source.

Each system has part of the story.

Correlation creates context.

Why Recovery Needs Monitoring

Suppose a compromised firewall is rebuilt.

The security team verifies the configuration.

Now operations still needs to know:

Is the site online?

Did the VPN return?

Are phones registered?

Can the site reach critical applications?

Is the backup circuit behaving correctly?

Cybersecurity recovery and operational recovery overlap.

A system is not fully recovered merely because it is clean.

The business function also needs to work.

Recovery Should Establish a New Baseline

After a serious incident, organizations should know what normal looks like again.

That may include:

Monitoring can then identify deviations from that known state.

25 Questions to Ask After a Server Compromise

  1. How did the attacker get in?
  2. When did the compromise begin?
  3. Which account was used?
  4. What privileges did that account have?
  5. Did the attacker obtain administrator or root access?
  6. Were passwords changed?
  7. Were new accounts created?
  8. Were SSH keys added or removed?
  9. Were authentication settings modified?
  10. Were security tools disabled?
  11. Were logs modified or deleted?
  12. What commands were executed?
  13. What files were downloaded?
  14. What files were created or changed?
  15. Did the attacker install persistence?
  16. Did the attacker obtain additional credentials?
  17. Did the attacker access other systems?
  18. Did lateral movement occur?
  19. Did the system communicate with attacker infrastructure?
  20. Was data accessed or transferred?
  21. What vulnerability or weakness enabled entry?
  22. Has that weakness been remediated?
  23. Have affected credentials and keys been rotated appropriately?
  24. Can the restored system be trusted?
  25. What monitoring will confirm that the attacker does not return?

The Better Question Is Not “Did We Get the Server Back Online?”

Ask:

Do we know how the attacker entered?

Do we know what they changed?

Do we know what credentials they obtained?

Do we know whether they created persistence?

Do we know whether they reached other systems?

Did we remove every known entry point?

Did we eradicate the attacker's foothold?

Did we restore from a trusted state?

Are we monitoring for recurrence?

That is incident recovery.

Key Takeaway

The most important part of the honeypot story may not be that attackers found the exposed server.

It is what happened after access.

One attacker reportedly removed legitimate SSH keys, added an attacker controlled key, and changed the root password.

Those actions illustrate a critical cybersecurity concept:

Persistence.

MITRE ATT&CK specifically documents SSH authorized key modification and account manipulation as techniques adversaries can use to maintain access.

And NIST's current incident response guidance makes clear that response does not end at containment. Eradication may require eliminating persistence mechanisms and entry points, disabling breached accounts, removing malware, and mitigating exploited vulnerabilities.

Source: MITRE ATT&CK https://attack.mitre.org/techniques/T1098/004/

https://csrc.nist.gov/pubs/sp/800/61/r3/final

The business lesson is straightforward:

> Getting the attacker out is different from stopping the attack.

You need to understand:

How they entered.

What they changed.

How they planned to return.

What else they reached.

What credentials they obtained.

Whether the system can still be trusted.

Then you can contain, eradicate, recover, verify, and monitor.

Because:

> Restoring service does not prove the attacker is gone.

And:

> A server being online tells you that it is available. It does not tell you that it is trustworthy.

Frequently asked questions

What do hackers do after they gain access to a server?

They may establish persistence, escalate privileges, steal credentials, disable defenses, discover other systems, move laterally, download malware, steal data, or use the compromised system for other attacks.

What is persistence in cybersecurity?

Persistence is an attacker's ability to maintain access despite interruptions such as password changes, reboots, or defensive actions.

What is a backdoor?

A backdoor is an unauthorized mechanism that enables continued or alternative access to a system.

What is an SSH key?

An SSH key is part of a cryptographic authentication mechanism commonly used for remote administration.

Can hackers add their own SSH keys?

If attackers obtain sufficient privileges, they may modify authorized SSH keys. MITRE ATT&CK documents this as a persistence technique.

Does changing a password remove a hacker?

Not necessarily. The attacker may have added another account, key, token, service, or other persistence mechanism.

Does rebooting a server remove malware?

Not necessarily. Many persistence mechanisms survive reboots.

What is privilege escalation?

Privilege escalation is the process of obtaining greater permissions than the attacker initially possessed.

What is lateral movement?

Lateral movement is when an attacker uses access to one system or identity to reach additional systems or resources.

Why do attackers disable security tools?

Disabling or impairing security tools can reduce detection and make additional malicious activity easier.

What is command and control?

Command and control describes communications used by attackers to manage compromised systems and send instructions or payloads.

What is containment?

Containment limits the scope or impact of an active incident.

What is eradication?

Eradication removes the attacker's foothold, persistence mechanisms, malware, compromised accounts, and exploited weaknesses.

What is recovery?

Recovery restores systems and business services to a trusted operational state and monitors for recurrence.

Is a server safe because it is working normally again?

No. Availability does not prove integrity or that attacker persistence has been removed.

Should a compromised server be rebuilt?

Depending on the scope and severity of compromise, rebuilding from known good sources may provide greater assurance than attempting to reverse every unauthorized change.

Are backups enough after a cyberattack?

No. Backups are essential for recovery, but they can contain vulnerable or compromised states and do not replace containment, eradication, credential remediation, and investigation.

What is an indicator of compromise?

An IOC is evidence that may indicate malicious activity, such as a malicious hash, domain, IP address, unauthorized account, unexpected SSH key, or suspicious process.

Why are logs important after a breach?

Logs can help determine when access occurred, which accounts were used, what changed, where the attacker connected, and how far the incident spread.

Why is centralized logging useful?

It can preserve evidence outside the compromised system and provide broader context across multiple systems.

How do I know whether the hacker is gone?

There is no single test. Responders need to investigate affected systems, identities, persistence mechanisms, credentials, network activity, vulnerabilities, and related infrastructure.

Sources

Editorial note

Cybersecurity risk and the controls appropriate to it vary by organization. Evaluate these recommendations against your own technology environment, business requirements, regulatory obligations, threat profile and risk tolerance.

Talk to us about your network security

USA Telecom Consulting LLC is a Service-Disabled Veteran-Owned Small Business running a 24/7 NOC. We monitor networks, circuits and firewalls for regulated and defense-supply-chain organizations.

Related articles

How do I know if someone is hacking my network? · What is a botnet and how does it work? · Is RDP or SSH safe to expose to the internet? · Microsoft fixed it. Why did companies still get hacked? · What is malware, and how do you know if a file is malicious?

← More from the ADAM Pulse Knowledge Base

Prepared by ADAM Pulse (USA Telecom Consulting LLC) — managed AI governance, network, and NOC services. Support: (888) 989-4872 · support@adampulse.us