Stealthy 'sedexp' Linux malware evaded detection for two years

Aon/Stroz Friedberg researchers detail 'sedexp', a stealthy Linux malware active since at least 2022 that achieves persistence by adding malicious udev rules (triggering on /dev/random), masks itself via memory manipulation and process naming, establishes reverse shells for remote access, and has been used to hide credit-card scraping on compromised web servers.