Fileless malware whose sole focus is root escalation.

Primary infection path seems to require root access at the very least, breaking out of SELinux/AppArmor as well if the infection vector is passed through an exploit. This post doesn't seem to say where the infection is coming from, I'm guessing the people who analyzed it haven't found a propagation method yet.

Perhaps it's installed through infected packages? Sabotaged repositories? Privilege escalation by `alias`ing `sudo`?