I had a similar experience with AWS. They warned us of a crypto hijacking of one of our servers. They weren't any help on internally battling it. They were hands off on anything within the server, and didn't have any advice on how to address it. I had to manually battle it. Their backup and device swapping services were pretty handy though.