My DigitalOcean server was infected on 5/25 with a Crypto-Miner botnet malware.
It comprised 3 parts:
A) The Crypto-Miner: maxed out my CPU to mine monero. That's what made me notice something was off.
B) Backdoor/persistence/rootkit module. Killed logs, made itself restart when killed.
C) Unsure as of currently.

From reversing the (B) module, it connects to a Command and Control Server, with the IP of 146.185.171.227. This IP is hosted on DigitalOcean's servers, and is currently programmed to crawl through DigitalOcean's network, infecting as it goes.