Background On June 21, 2019, we published a blog about a Proxy Botnet, Linux.Ngioweb. On August 4, 2020, we captured a batch of ELF files with zero VT detection, which are variants of Ngioweb.And we just named it V2. Two weeks later, on August 16, we noticed that