… hidden directory

0001-01-01

“…” is a common choice for a name of a hidden folder on Linux and Unix-like systems by malware and threat actors.

This is due to the . (current working directory) and .. (previous directory) filesystem members within every directory. “.” and “..” aren’t shown in a typical directory listing. Neither is “…” because it begins with a period.

“…” is popular likely because it blends in with typical output of “ls -a”, and is likely to be glossed over by people casually poking around on the filesystem.