Linux admins,

Finding the malware is only the beginning. This week's stories focus on what happens after attackers get in, from persistence mechanisms that survive cleanup efforts to authentication paths that bypass common security assumptions. Both serve as a reminder that effective defense depends on understanding attacker behavior, not just applying patches.

Yours in Open Source,

Dv Signature Newsletter 2026 Esm W100

Dave Wreski, Founder

Persistence Often Outlives the Malware

Attackers rarely rely on a single payload. Instead, they establish multiple ways to regain access by abusing cron jobs, systemd services, SSH authorized keys, startup scripts, and other trusted Linux features. During an investigation, removing a malicious binary without identifying the persistence mechanism can allow an attacker to return long after the system appears clean. Treat persistence hunting as a required step in every Linux incident response.

→ Learn how to investigate persistence mechanisms on Linux

 

Cloud Identity Is Now Part of Linux Security

A recently disclosed Azure CLI password spraying campaign demonstrates how attackers are targeting cloud identity rather than the operating system itself. By authenticating through non-interactive workflows, they can avoid some of the protections organizations associate with standard Microsoft 365 sign-in experiences. As more Linux workloads depend on cloud identities, monitoring authentication activity becomes just as important as monitoring the servers themselves.

→ Read about the Azure CLI password spraying campaign