Two WP Installations of AWS Webspace suddenly show 502 Bad Gateway

Hello Support,

this morning suddenly one of two sites on the same Amazon AWS Webspace showed "502 Bade Gateway nginx/1.4.6 (Ubuntu)", but I could still login to the Backend. I disabled all plugins except for security. Then tried to install wpmu dev dashboard, but Transmit says "folder cannot be created".

After that, I found that the style file from the Enfold Child Theme was still there but empty. Transmit says that file cannot be updated, writing error. Strangely suddenly there are some more files in the child theme called e.g. "style_safe_save_095042.css".

After that, the other WP site on the webspace began showing the same symptoms.

Do you have any idea what could be happening there? Is someone hacking the sites perhaps?

Thanks for your help,
best,
Julian