Yes, but somehow it affects all processes and installs a rootkit. That's going to need more than an unprivileged user account's access to the system. It's not c

Yes, but somehow it affects all processes and installs a rootkit. That's going to need more than an unprivileged user account's access to the system. It's not clear from the article how that access is gained. > Instead of being a standalone executable file that is run to infect a machine, it is a shared object (SO) library that is loaded into all running processes using LD_PRELOAD (T1574.006), and parasitically infects the machine. Once it has infected all the running processes, it provides the threat actor with rootkit functionality, the ability to harvest credentials, and remote access capability.