New in-memory rootkit discovered by German hoster

einar2 writes: German hoster Hetzner informed customers that login data for their admin surface might have been compromised.
End of last week, a backdoor in a monitoring server was found. Closer examination led to the discovery of a rootkit residing in memory. The rootkit does not touch files on storage but patches running processes in memory. Malicious code is directly injected into running processes. According to Hetzner the attack is surprisingly sophisticated. (link in German)