The title is quite clickbaity I think, because of this:<p>> Occurred no later than August 12, 2011, and wasn't detected for another 17 days<p>which also had a discussion on HN in 2013:<p><i>Who rooted kernel.org servers two years ago?</i> (<a href="https://news.ycombinator.com/item?id=6438326">https://news.ycombinator.com/item?id=6438326</a>) - Sep 2013 (45 comments)<p>The article from ESET is here,<p><i>Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain</i> (<a href="https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-linux-servers-compromised-cryptotheft-financial-gain/" rel="nofollow">https://www.welivesecurity.com/en/eset-research/ebury-alive-...</a>) - May 2024<p>but the article itself only serves as an introduction to the PDF:<p><a href="https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf" rel="nofollow">https://web-assets.esetstatic.com/wls/en/papers/white-papers...</a>