LOKI2 is a backdoor that targets Unix-like systems such as Linux that uses the ICMP protocol as a covert channel.
LOKI2 was documented and released in Phrack Magazine issues 49 and 51, respectively. LOKI2’s source code is credited to route and alhambra.
This malware leverages the fact that network security solutions at the time largely ignored ICMP traffic, focusing only performing inspections on TCP and UDP packets.
LOKI2 was modified and used by the Turla group. This modified strain is known as Penguin Turla.
http://phrack.org/issues/49/6.html http://phrack.org/issues/51/6.html