t0rn rootkit

The t0rn rootkit is a binary replacement rootkit for Linux by J0hnny7 that infects hosts by replacing system utilities such as find, ls, ps, pstree, du, netstat, etc. with pre-compiled copies that filter out results indicating the presence of the attacker.

https://www.giac.org/paper/gcih/321/t0rn-rootkit/103430

---