Hello all.



I've installed Devuan 6 (Excalibur) on few servers/workstations. Today it is 6 computers.



I have Wazuh in my network. Wazuh informs that on each of this computers

I have:



Trojaned version of file '/usr/bin/chsh' detected. Signature used: 'bash|file\.h|proc\.h|/dev/ttyo|/dev/[A-Z]|/dev/[a-s,uvxz]' (Generic).



Trojaned version of file '/bin/passwd' detected. Signature used: 'bash|file\.h|proc\.h|/dev/ttyo|/dev/[A-Z]|/dev/[b-s,uvxz]' (Generic).





IKIR IT Chief. Arcady Ivanov.

phone: +7(914)024-4191

mailto: arc@???