Also just suspended a decent number of VPS's who were effected by this. I checked the admin access logs for one client and see that the admin account was accessed by these two IP addresses: 178.248.23.122 and 178.248.23.174
Nulled 178.248.23.0/24 across all servers.