Technology

There's also a buried reference to using a several-years-patched gpac bug to gain root access before this thing can do most of its stealth stuff.

Basically, it needs your system to already have a known, unpatched RCE bug before it can get a foothold, and if you've got one of those you have problems that go way beyond stealth crypto miners stealing electricity.

Your install USB is infected by a rookit and reinstalls itself on connect.

This was my first thought. I haven’t had the same os installed for a few months max, nevermind 3 years

Crowd strike looking for a new market?

ssh with an easy to guess root password?

what does FUD stand for?

The whole thing sounds fishy. Like it's trying to convince people Linux is inherently vulnerable.

exploiting more than 20,000 common misconfigurations

Like WTF?

They have an "attack flow" diagram that seems to indicate a hacker installing it directly through a known vulnerability.

It probably has a large database of exploits it can use. The article claims 20k, but this seems to high for me.

That's how some people found it, but it would disappear when someone would login to investigate.

Yes, but they replace common tools like top or lsof with manipulated versions. This might at least trick less experienced sysadmins.

Edit: Some found out about the vulnerability by ressource alerts. Probably very easy in a virtualized environment. The malware can't fool the hypervisor ;)

Vulnerable to 20,000 misconfigurations, But thearted by 42 billion different simple checks that we all do anyway.

5 minute load greater than 80% of the number of cores? That's an alarm.....

Mine is ultra low voltage and I barely maintain it so this article gave me a bit of a scare. I’ll probably wipe it by the next reinstall anyway since it’s been nearly 10 years of Ubuntu LTS upgrades and it’s a mess (both what I’ve done to it and what Ubuntu has done to itself).