In this campaign, the threat actor also uses “init” and “systemd” services for persistence. The name of the service is “netdns. Below is a snippet from the setup script used by Rocke in a previous campaign that also uses the serviced called netdns