Wikileaks reveals CIA's BothanSpy: exfiltrating SSH keys and passwds (Linux/Win)

Gyrfalcon has a very primitive attack methods: LD_PRELOAD (omg!) and ptrace (see linux/Documentation/security/Yama.txt).

If this is a CIA level, then it's very sad.