I have no idea why, but I can elaborate a bit. Here are some highlights: > Using a Unix socket over TOR for external communications This is being said under t

I have no idea why, but I can elaborate a bit. Here are some highlights: > Using a Unix socket over TOR for external communications This is being said under the implication of sophistication. Using TOR for exfiltration or C2 related activities is amateur as it obviously will be detected. A minimum standard in this category for malware is something that makes use of primary gadgets of trusted hosts like Google, Microsoft or Apple. A more sophisticated area of this are various abuses of DNS and other accepted protocols where data can be stuffed into "trusted" records by places like Cloudflare. > Stopping activities that are easy to detect when a new user logs in This and a few other "points" like this seem like filler. This has been a thing malware does since the beginning and is the most basic anti-detection "technique" possible. > Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic At least he mentions the specific thing being hooked here, but again, the idea that malware would override the system or an API in some way to lie to the rest of the system is one of the most fundamental things a malware can do. > It gets installed by exploiting more than 20,000 common misconfigurations That's probably a very long-winded and hand-wavy way to say they are probably using Metasploit or similar.