They are using Linux as the hook in the headline, the attack on kernel.org was widely reported when it happened, over a decade ago, although maybe not so publicly dissected. There was even an arrest.

The same malware is still active in the wild and attacking other people, that’s the real point of the article.

Maybe a better title would have included “from 2009 to 2011”

Dan Goodin seems to write sensationalist articles of vulnerabilities. Then buried in a footnote you notice that the vulnerability doesn’t really affect anyone in real world.

I routinely skip arstechnica articles. Too much sensationalism (for example the notorious ZFS article). It also collects way too much data about its visitors.