It was found on 7/22/2022 Friday morning, the access to dev site was denied. Later on, it was found not just the dev site, but other sites that are hosted on the same dedicated server were also infected.
After going through extensive scanning and cleaning on existing sites files, all sites now are running as expected.