So somebody used shellshock to break in, then plugged the hole to prevent others from accessing the server, and is now using your server for... whatever?