I routinely use two of the larger EMRs, Epic and Cerner, at multiple sites and between different hospital groups. They all run as RDP/Citrix remote Windows sessions. I've run exactly the same sessions on a Linux machine. The underlying host OS is not that important.
Shortly after Mark launched The Facebook in his dorm room:
Zuck: Yeah so if you ever need info about anyone at Harvard
Zuck: Just ask.
Zuck: I have over 4,000 emails, pictures, addresses, SNS
[Redacted Friend's Name]: What? How'd you manage that one?
Zuck: People just submitted it.
Zuck: I don't know why.
Zuck: They "trust me"
Zuck: Dumb fucks.
Possible answer to your question. From the article;
"Once installed, the main Project Sauron modules start working as 'sleeper cells,' displaying no activity of their own and waiting for 'wake-up' commands in the incoming network traffic," Kaspersky researchers wrote in a separate blog post. "This method of operation ensures Project Sauron’s extended persistence on the servers of targeted organizations."
So, how does it continuously poll network traffic looking for 'wake-up' commands? Is that not activity?
Never buy from a rich salesman. -- Goldenstern