Per the sibling comments, I'd definitely like to know more detail. I rely on Streisand when in China and so if it's something to do with Streisand itself then I want to be aware of that.

Do you have further details? I mean this could be your server having SSH open and a weak root password, or it could be an exploit which hit Streisand, but we can't tell which ..

Replying to myself, I accepted what Vultr had to say and killed the server. Wasn’t really worth me investigating too deeply and I took them on their word.

I did the default Streisand install with all services, and disabled password based login on the box (keys only).

It seems Streisand has some issues updating some components according to their issues board and it seems like the maintainer might have abandoned it.

Next time I’ll probably use algo instead. I just need wireshark anyways ;)

Compromised due to Streisand being vulnerable or what?