[lawnchair_larry]

Or just check if your instance was restarted and your root password was changed. If it wasn't, you were not exploited this way.