/dev/shm is a better hiding place than /tmp or /var/tmp because if someone notices something weird on a server their instinct might to be power it off or reboot

/dev/shm is a better hiding place than /tmp or /var/tmp because if someone notices something weird on a server their instinct might to be power it off or reboot it. A power cycle will wipe /dev/shm since it is memory backed storage. Lots of places will remove the network, power off the machine, and disk image the affected server for later analysis.