I guess this will only grow in volume. Nobody seems to acknowledge the task of an admin, that keeps things updated and secure and that can implemented preventive security measures. It's mostly hire someone as cheap as possible to install xyz on a rented dedicated box and forget about it.

Add some sloppy password policy, lot's of PHP code that is neither sandboxed or updated and you'll have an easy time to own such machines.

And if it's hacked and disabled it just get's reimagined. I guess most don't even notice if you don't do anything that get's on the providers radar.

But honestly even as toying around with Linux for more than 15 years I'd have a hard time to find a rootkit in daily ops that successfully managed to load as kernel module or via ld-preload.

Graphing the load e.g. munin is sometimes useful but that's more like having some post-mortem tools.