That’s how some people found it, but it would disappear when someone would login to investigate.

Vulnerable to 20,000 misconfigurations, But thearted by 42 billion different simple checks that we all do anyway.

5 minute load greater than 80% of the number of cores? That’s an alarm…

Yes, but they replace common tools like top or lsof with manipulated versions. This might at least trick less experienced sysadmins.

Edit: Some found out about the vulnerability by ressource alerts. Probably very easy in a virtualized environment. The malware can’t fool the hypervisor ;)