The SSHStalker Linux botnet has ensnared 7,000 systems, deploying various scanners and malware, an IRC bot, and multiple kernel exploits.
No installs required: history search, redirection, job control, completions, and other built-in terminal features that exploit the power of Linux.