A Linux server looked completely normal.

No CPU spike.
No service crash.
No failed logins.

Still felt off.

The only reason I noticed it was because outbound traffic looked slightly different than usual.

Not high.
Just… different.

That ended up leading to something I wasn’t expecting.

Most compromises don’t announce themselves loudly anymore.

They drift.