" Once root access has been obtained, a rootkit known as
"phalanx2" is installed.
"Phalanx2 appears to be a derivative of an older rootkit named
"phalanx". Phalanx2 and the support scripts within the rootkit, are
configured to systematically steal SSH keys from the compromised