Advanced Persistent Threat (APT) hackers had hacked into my Virtualmin Linux Virtual Private Server (VPS) on 15 Dec 2025 Monday around noon time

Subject: Advanced Persistent Threat (APT) hackers had hacked into my Virtua=
lmin Linux Virtual Private Server (VPS) on 15 Dec 2025 Monday around noon t=
ime

Good day from Singapore,

Today 17 Dec 2025 Wednesday around 12.30 PM, I was trying to use GMail (Goo=
gle Mail) to send email to my email accounts hosted in Virtualmin Linux Vir=
tual Private Server (VPS) (aka web hosting control panel). GMail reported t=
he error "554 5.7.1 Relay access denied". Which means all of my email accou=
nts hosted in Virtualmin Linux VPS could no longer receive emails.

Advanced Persistent Threat (APT) hackers must have hacked into my Virtualmi=
n Linux VPS and changed my server configuration.

Webmin version: 2.520
Virtualmin version: 7.50.0 GPL
Operating system: AlmaLinux 9.6
Usermin version: 2.420
Authentic theme version: 25.20
Linux Kernel and CPU: Linux 5.14.0-570.51.1.el9_6.x86_64 on x86_64

When I logged in to Roundcube Webmail, I noticed that I had stopped receivi=
ng emails with the email accounts hosted in Virtualmin Linux VPS since 15 D=
ec 2025 Monday around 12 noon Singapore Time.

When I checked /var/log/maillog in Virtualmin Linux VPS, I observed that I =
had started getting "554 5.7.1 Relay access denied" errors since 15 Dec 202=
5 Monday around 12.28 PM (for my email accounts hosted in Virtualmin Linux =
VPS).

Advanced Persistent Threat (APT) hackers must have hacked into my Virtualmi=
n Linux VPS and changed my server configuration.

When I checked /etc/postfix/main.cf on my Virtualmin Linux VPS, Advanced Pe=
rsistent Threat (APT) hackers had changed the following line to:

mydestination =3D $myhostname, localhost.$mydomain, localhost, ns1.turritop=
sis-dohrnii-teo-en-ming.com

I had to change the above line back to:

mydestination =3D $myhostname, localhost.$mydomain, localhost, ns1.turritop=
sis-dohrnii-teo-en-ming.com, teo-en-ming.com, teo-en-ming-corp.com

And then restart Postfix daemon/service (systemctl restart postfix).

For Virtual Server teo-en-ming-corp.com in Virtualmin Linux VPS:

Advanced Persistent Threat (APT) hackers had changed my email account user'=
s Login access to Database, FTP and SSH. I had to change it back to Databas=
e, Email, FTP and SSH.

Advanced Persistent Threat (APT) hackers had also changed "Primary email ad=
dress enabled" to No. I had to change it back to Yes.

For Virtual Server teo-en-ming.com in Virtualmin Linux VPS:

Advanced Persistent Threat (APT) hackers had changed my email account user'=
s Login access to FTP and SSH. I had to change it back to Email, FTP and SS=
H.

Advanced Persistent Threat (APT) hackers had also changed "Primary email ad=
dress enabled" to No. I had to change it back to Yes.

After making all of the above changes, I am able to start receiving emails =
with my email accounts hosted in Virtualmin Linux VPS since 1.15 PM today 1=
7 Dec 2025 Wednesday.

When I checked OpenSSH server logins and Virtualmin logins, only public IPv=
4 addresses belonging to me were present. There were no traces of Advanced =
Persistent Threat (APT) hackers gaining unauthorized entry into my Virtualm=
in Linux VPS at all. Of course, if they are Advanced Persistent Threat (APT=
) hackers, they must be very smart and intelligent (their intelligence quot=
ient IQ sure way above me) to remove all traces of their unauthorized intru=
sions into my Virtualmin Linux VPS.

How can I make a request to Advanced Persistent Threat (APT) hackers so tha=
t they will stop playing pranks on my Android (Linux) phones, home desktop =
computer, laptops, Virtualmin and Webmin Linux servers and other various nu=
merous online accounts not secured with 2FA / MFA?

Please advise.

Thank you very much.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Extremely Democratic People's Republic of Singapore
17 Dec 2025 Wednesday 3.50 PM Singapore Time