cpuminer

Your system has been rooted. The miner itself isn't relevant information...that's just what they decided to do with the rooted system. The fact that they haven't hidden it from you is an indicator that they didn't install a rootkit (or didn't know how to use it, if they did), which could hide the miner from the process list.

There was a series of major vulnerabilities discovered in both Intel and AMD CPUs recently, which could be exploited on any OS to escalate privilege. If your kernel wasn't updated quickly, and an untrusted user had any kind of user access, that could explain the escalation (I don't know the details of those exploits, but I know they could be used to obtain sensitive information from memory...probably including passwords). How the attacker initially got into your system could be all sorts of things...exploitable web apps, weak password, a legitimate user gone rogue, etc.

Anyway, you can't trust your server anymore without a reinstall. Even though it doesn't look like they installed a rootkit (since you can see the miner process) I'd be surprised if they didn't. So, back up your data, and either migrate to a new VM (if this is a virtual machine), or reinstall your OS (deleting all the existing filesystems and starting from scratch). You can run tools like rkhunter and chkrootkit, which might sniff the problems out, it's impossible to know for sure...because a rootkit can theoretically completely hide itself from detection (though realistically they are rarely completely undetectable).

In terms of avoiding it in the future: Make sure you stay up to date. The most common cause of exploited systems is old software (whether services, kernel, or web apps), followed closely by weak passwords and other poor practices (repeating passwords on multiple systems, for example). Things like firewalls are band-aids, at best...fail2ban can prevent brute force attacks, but won't make an exploitable application or service safe.

Oh, and if you're backing up and starting over on the same system, I'd recommend two kinds of backup. Virtualmin backups are usually reliable, but it's likely there are things you configured outside of Virtualmin that are important. So, backup /etc, /var, and /home, at least, independently of the Virtualmin backups. /bin and /usr/bin and /lib and /usr/lib are all provided by the OS, so can generally be ignored in backups.

Also keep in mind that when restoring a backup from a rooted machine, there may be bombs that can re-infect the new machine. I would not restore /etc in bulk; I would only pull out the specific things you need (if any beyond what Virtualmin backs up) because there could be a bomb waiting for the next boot in rc files, systemd unit files, or any of the other executable bits in /etc. I would look it over pretty carefully, even if just restoring the Virtualmin backups...a determined and knowledgeable attacker could modify Virtualmin created scheduled jobs, for example.