> What kind of jerk would attack Arch Linux?

The answer is: Russians

Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely.

Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware.

[1] https://github.com/cookiengineer/antimiasma

[2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...