The title is quite clickbaity I think, because of this:<p>> Occurred no later than August 12, 2011, and wasn't detected for another 17 days<p>which also had a discussion on HN in 2013:<p><i>Who rooted kernel.org servers two years ago?</i> (<a href="https://news.ycombinator.com/item?id=6438326">https://news.ycombinator.com/item?id=6438326</a>) - Sep 2013 (45 comments)<p>The article from ESET is here,<p><i>Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain</i> (<a href="https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-linux-servers-compromised-cryptotheft-financial-gain/" rel="nofollow">https://www.welivesecurity.com/en/eset-research/ebury-alive-...</a>) - May 2024<p>but the article itself only serves as an introduction to the PDF:<p><a href="https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf" rel="nofollow">https://web-assets.esetstatic.com/wls/en/papers/white-papers...</a>
> Maintainers reneged on a promise[0] to provide an autopsy of the hack, a decision that has limited the public’s understanding of the incident.<p>[0] <a href="https://arstechnica.com/information-technology/2013/09/who-rooted-kernel-org-servers-two-years-ago-how-did-it-happen-and-why/" rel="nofollow">https://arstechnica.com/information-technology/2013/09/who-r...</a><p>This bit makes it sound like 3 letter agencies were involved?