I got an email at about 15:30 from my cloud server provider saying that it looked like the server I rent is being used to brute-force attack other servers. On a Sunday of all days!
Long story short, it was. I turned it off for a while until I decided what to do, which was basically clean out all I could find, add some extra security, and hope for the best. It's back up now, and fingers crossed that all fixed.