In the meanwhile, it seems that the BKA (German Federal Criminal Police Office) has lifted their ban on speaking about the issue and Martin Hetzner, the founder of hetzner.de, has issued a statement on how to find the rootkit if it has been planted on a server:

- Use gdb to take a RAM-dump of the SSHD process

- Use strings and grep to find one of the following strings:

key=xxx

dhost=xxx

hbt=3600

sp=xxx

sk=xxx

dip=xxx

The following step-by-step instructions should work for Debian-based systems:

aptitude install gdb

gdb --pid=`ps ax|grep "\/usr\/sbin\/sshd"|cut -d" " -f1`

> gcore

> quit

strings core.XXXXX |grep "key="

If the server's clean, this grep should come up empty.

It seems that as of today it is still unclear how the infection/intrusion has been done in the first place.