For a long time, Linux malware followed a familiar pattern. A compromised host. A binary written to disk. Persistence through cron, systemd, or a quiet modification that survived reboots. If you hardened the system and watched for changes, you felt reasonably in control. That model no longer matches how Linux is actually run. Modern Linux malware increasingly assumes it is landing in environments where hosts are disposable, workloads are short-lived, and the real authority sits somewhere above the operating system.

Source: Evolving Linux Malware Threats: A Guide for Admins in Cloud-Native Contexts