“We named it RotaJakiro based on the fact that the family uses rotate encryption and behaves differently for root/non-root accounts when executing.”
The command servers were registered in December 2015. Samples on VirusTotal go back to 2018, and none of the antivirus engines flagged them. A Linux backdoor ran unnoticed for years. The myth that Linux servers don’t need malware detection is how this one stayed hidden.