The above notes should get you protected better than 99.9% of people on the internet.
Anti virus wouldn't really help in this case. I should also point out that it appears that HiddenWasp is targeting systems that are already compromised in some form.
The "achilles heel" of these sorts of CnC attacks tends to be, and is apparently so in this case, that they do need to phone home.
In this case, the IP addresses are known, and blackholing them with your firewall (try something like ufw [1], if you don't have one), or your hosts file, is enough. Using something like pi-hole you can also deploy these protections for every device on your network.
There are quite a few hosts lists maintained out in the wild [0], and tools like fail2ban to protect against brute-force attacks.
But, as usual, by far and away the safest way to protect your system is to not run untrusted code. You probably have a package manager, going outside it tends to be less safe.
[0] For example: https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist
[1] https://wiki.archlinux.org/index.php/Uncomplicated_Firewall#...
Also if your Linux / UNIX machine has an addressable WAN IP then you have all the usual risks of involved with hosting services on the public internet. A few years ago there was a spate of compromised web servers with the malware running as Apache modules.
So there aren’t really any guarantees when running Linux.
You're also assuming that the linux server is the initial attack vector.
It is not uncommon for an org to be breached, and for the adversary to pivot to an admin box, and for the adversary to then gain control of a server using the admins legitimate credentials. All the while dropping persistence mechanisms along the way. Secure configurations and setups are always recommended and the above information is great advice. BUT it is also dated advice.
If you're not actively monitoring these servers and the activity on these servers they will eventually be popped. Logging all process/CLI activity is an awesome way to get started on monitoring, but if you're going that route, deploying Wazuh or an EDR tool can only add extra value by allowing you to create alerts off of specific values.
If this is something you want from your email provider, along with some other simple defenses [1][2], then please drop me an email at [email protected], I work on an email startup in private beta.
[1] https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hid...
[2] https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin...
Looking at the original post - some of those would be monitoring the the bash history environment variables. This is commonly modified by threat actors as a defense evasion technique. (I see it a bunch with insider threats to)
There's a bunch of others - but having just that one alert trigger would have likely been enough to start an investigation and catch this malware should the protective controls others have recommended fail.
That said the tools to do the more necessary modern monitoring do typically require more maintenance and configuration and it's not typically a set and forget type of solution.
Options I'd recommend:
LimaCharlie - https://limacharlie.io - Cloud based EDR tool, it has a cost, but is not expensive ($1 per endpoint monitored, supports all Linux flavors). It's a lot easier to deploy and manage, but you'll have to write your own rules. This though will also allow you to remotely look at all processes/pull files off of a machine remotely/isolate hosts on the network etc
There are a bunch of other EDR tools out there like Carbon Black or CrowdStrikes/FireEye's tooling, but they run a high premium ($20-40 per end point, and typically only support Ubuntu or Redhat or both)
Wazuh - https://wazuh.com/ - It's a better maintained fork of OSSEC that makes mass deployments easier/has more default rules etc. It'll give you FIM/Notify you of insecure configurations etc - This one will require the most work to setup
Security Onion - https://securityonion.net/ - this one is probably a little overkill, but modern versions include Wazuh (as seen above) as well as OSQuery/Network IDS's (which are it's core feature)