Comment by Shank

I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.