Also if your Linux / UNIX machine has an addressable WAN IP then you have all the usual risks of involved with hosting services on the public internet. A few years ago there was a spate of compromised web servers with the malware running as Apache modules.
So there aren’t really any guarantees when running Linux.
You're also assuming that the linux server is the initial attack vector.
It is not uncommon for an org to be breached, and for the adversary to pivot to an admin box, and for the adversary to then gain control of a server using the admins legitimate credentials. All the while dropping persistence mechanisms along the way. Secure configurations and setups are always recommended and the above information is great advice. BUT it is also dated advice.
If you're not actively monitoring these servers and the activity on these servers they will eventually be popped. Logging all process/CLI activity is an awesome way to get started on monitoring, but if you're going that route, deploying Wazuh or an EDR tool can only add extra value by allowing you to create alerts off of specific values.
If this is something you want from your email provider, along with some other simple defenses [1][2], then please drop me an email at [email protected], I work on an email startup in private beta.
[1] https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hid...
[2] https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin...
Anti virus wouldn't really help in this case. I should also point out that it appears that HiddenWasp is targeting systems that are already compromised in some form.
The "achilles heel" of these sorts of CnC attacks tends to be, and is apparently so in this case, that they do need to phone home.
In this case, the IP addresses are known, and blackholing them with your firewall (try something like ufw [1], if you don't have one), or your hosts file, is enough. Using something like pi-hole you can also deploy these protections for every device on your network.
There are quite a few hosts lists maintained out in the wild [0], and tools like fail2ban to protect against brute-force attacks.
But, as usual, by far and away the safest way to protect your system is to not run untrusted code. You probably have a package manager, going outside it tends to be less safe.
[0] For example: https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist
[1] https://wiki.archlinux.org/index.php/Uncomplicated_Firewall#...