The attack appears to rely on stolen SSH keys to gain access to a system and then uses a local kernel exploit to gain root access, whereupon it installs the “phalanx2″ rootkit.