See relevant thread in r/netsec: https://www.reddit.com/r/netsec/comments/40lotk/ssh_backdoor...

> It leaves no traces in any logs (wtf?). It keeps working even if you disable "FMG-Access". It won't let you define an admin user with the same name to mitigate it, so make sure that SSH access on your devices is at least restricted to trusted hosts!