The Root Password Changed at 10:17 and Nobody Logged In — The VM Console Path Your Firewall Never Sees
A customer’s Ubuntu VM had its root password changed at 10:17 with no SSH, console or panel login at that time. The firewall was clean. The entry had come through the cloud portal’s VM console two nights earlier, through a build-time user with an old password, and the password change itself was made by a tampered guest-tools agent. Here is the evidence chain, the three persistence mechanisms, the cleanup order and the checks.