10,000 Linux servers hit by malware serving spam and exploits

“Until now, publicly known details of the attack were largely limited to its use of a self-injecting rootkit—Phalanx or Phalanx2—to infect kernel.org servers known as Hera and Odin1, as well as personal computers belonging to senior Linux developer H. Peter Anvin. The malware had access to potentially sensitive information stored on the infected machines. A follow-up advisory a few weeks later opened the possibility that still other developers may have fallen prey to the attackers. According to Eset, kernel.org servers were probably infected by a second piece of malware dubbed Linux/Ebury, an OpenSSH backdoor used to keep control of the servers and steal credentials.”

http://arstechnica.com/security/2014/03/10000-linux-servers-hit-by-malware-serving-tsunami-of-spam-and-exploits/