Linux backdoor using ICMP payload for activation