If it is through the vm, it is more than likely that it is from the outside and someone should go on site and lock down the system until it is fully checked out. Make sure fwd external is disabled for ext that don't need it or are not used

“I have not failed. I've just found 10,000 ways that won't work.”