As people probably know by now, some hackers released a trojan "HiddenWasp" into the Linux world.
Article from Intezer:
So far I have not seen what the initial cause of getting infected is and how to prevent it, but I've read something about looking for a user "sftp" which is created by the trojan script, and then looking inside /etc/rc.local since it is supposed to only have "exit 0". The script appends some code to that file apparently.
There is also a hint to look for "ld.so" files that don't have string "/etc/ld.so.preload"
They mention that prevention can be done by blocking Command-and-Control IP addresses detailed on the article site.
How do i block off specific IP-addresses?