More details at: CrowdStrike: http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.html http://blog.crowdstrike.com/2012/11/http-iframe-inje

More details at: CrowdStrike: http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.html http://blog.crowdstrike.com/2012/11/http-iframe-injecting-li... Kaspersky: https://www.securelist.com/en/blog/208193935/New_64_bit_Linux_Rootkit_Doing_iFrame_Injections https://www.securelist.com/en/blog/208193935/New_64_bit_Linu... Both links were submitted to HN but didn't make the front page; I guess the third time's the charm? CrowdStrike in particular concludes, "Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely. It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely."