XZ backdoor: Hook analysis

Kaspersky's Part 3 analysis of the XZ backdoor describes a highly sophisticated OpenSSH backdoor that embeds an encrypted ED448 public key via code-level steganography, hooks RSA/OpenSSH authentication flows to allow arbitrary logins and fake-key authentication, supports remote command execution (including root-mode operations), and hides evidence by filtering syslog messages and replacing logged keys; the report includes anti-replay protections and provides vendor detection names (HEUR:Trojan.Script.XZ, Trojan.Shell.XZ, MEM:Trojan.Linux.XZ).