True, but I would confirm a device is compromised before nuking the OS, not just do it willy-nilly because maybe it could be. A better way to phrase what OP is asking is: what are some ways to troubleshoot this without making a ton of potentially unnecessary work for myself?
…to which I would say, run a netstat on any systems that can, check those IP’s against WHOIS and/or traceroute. Anything that traces to Eastern Europe, Russia, China, most of SEA is a red flag. Dig a little deeper with Wireshark or Glasswire to inspect some actual packets for suspicious content. I think there’s a network logger that can trace the process using a given connection, but the name eludes me).
Find your smoking gun, then torch the OS.
comic_zalgo_sans@lemmy.world 11 months ago
RagingNerdoholic@lemmy.ca 11 months ago
Absolutely. Use an efficient disk imager that can take incremental snapshots and you can keep backups for months or years without needing a ton of storage.