Technology

There's also a buried reference to using a several-years-patched gpac bug to gain root access before this thing can do most of its stealth stuff.

Basically, it needs your system to already have a known, unpatched RCE bug before it can get a foothold, and if you've got one of those you have problems that go way beyond stealth crypto miners stealing electricity.

It probably has a large database of exploits it can use. The article claims 20k, but this seems to high for me.

Crowd strike looking for a new market?

ssh with an easy to guess root password?

Your install USB is infected by a rookit and reinstalls itself on connect.

This was my first thought. I haven’t had the same os installed for a few months max, nevermind 3 years

The whole thing sounds fishy. Like it's trying to convince people Linux is inherently vulnerable.

exploiting more than 20,000 common misconfigurations

Like WTF?

They have an "attack flow" diagram that seems to indicate a hacker installing it directly through a known vulnerability.

Vulnerable to 20,000 misconfigurations, But thearted by 42 billion different simple checks that we all do anyway.

5 minute load greater than 80% of the number of cores? That's an alarm.....

Yes, but they replace common tools like top or lsof with manipulated versions. This might at least trick less experienced sysadmins.

Edit: Some found out about the vulnerability by ressource alerts. Probably very easy in a virtualized environment. The malware can't fool the hypervisor ;)

That's how some people found it, but it would disappear when someone would login to investigate.