What Happened
A developer discovered Agtisx.exe, a Windows executable, in a temp folder on their Linux server during the React2shell (CVE-2025-55182) campaign. The compromised server wasn't infected, it was weaponized: attackers were using it to distribute malware to Windows targets.
This is the cross-platform supply chain attack pattern that keeps enterprise architects awake. Your hardened Linux infrastructure becomes the staging ground for someone else's campaign.
What Actually Matters
The technical response is straightforward but often skipped:
Detection: ClamAV and Linux Malware Detect both scan Windows executables on Linux servers. ClamAV handles cross-platform threats better; LMD focuses on Linux-native malware. For Windows file detection on Linux, ClamAV with updated signatures and clamdscan for bulk scanning is the standard approach.
Forensics before deletion: The stat command reveals file creation time. Match timestamps against web server logs to identify the entry point. Check ownership with ls -la to determine if compromise happened via web app (www-data) or privilege escalation (root).
Recovery posture: Patching vulnerabilities like React2shell matters, but 60% of breaches still stem from unpatched systems. The data validates what most teams already know and ignore.
The Boring Stuff That Actually Works
SSH key rotation isn't incident response, it's scheduled maintenance. Secrets spread: CI configs, archived backups, forgotten laptops. Rotation limits blast radius.
Local firewalls (UFW) catch your own security group misconfigurations. Fail2ban handles brute force attempts automatically. systemctl list-unit-files --state=enabled surfaces persistence mechanisms.
The ss -antp command shows active connections. Random IPs and unknown processes deserve investigation, not assumptions.
The Real Question
Why do organizations with security teams still find mystery executables in temp folders? The technical controls exist. The gap is operational: 83% of IT teams enforce MFA, 41% implement zero-trust, but basic server audits remain inconsistent.
Compromised infrastructure doesn't announce itself. The file you don't recognize is the one that matters.