All 3 of the new devices have a description along the lines of "78MB Loop Device" and lists a backing file at location /var/lib/snapd/snaps/snapd_22291.snap (not exactly but they're all similar to this). They show as unmounted and I'm not really sure what this is.

Additionally when I try to use libation to pull my latest audible books down it says it can't read my local file location folder.

I recently saw the post about the plex vulnerability (which is part of why i was doing work on it, to make sure that my auto update was working) when I noticed this and it got me worried.

Are these new devices that showed up indicative that a malicious user has accessed my system through the internet and has setup a crypto miner to run in the background on my server or is it more likely that a disk is failing and this is the first sign?

Also before anyone feels the need to say it, I know that plex is not ideal and jellyfin is better, but I have remote users that I cannot talk through troubleshooting to get jellyfin when I can tell them to just install plex on their end.

Any help would be greatly appreciated