One of the cloud instances I manage got hacked. It is powered down at the moment, but I want to bring it up disconnected from the internet. So I can examine and analyze it with it continuing to do it's harm.
What do I need to do to make that happen?
SnapOverflow
Apply firewall rules to it that restrict all traffic, inbound and outbound, except that which is explicitly required for you to gain access to the server.
The best way to dig yourself out is to not start up this server again at all, but rather take an image of its storage volume and mount it on a separate server. Then you can recover data without taking a risk that the malicious code will become active again.