This is a first, as far as I can tell.
Instead, the author or authors of the malware appear to be using it to actually secure infected devices. Symanetc [sic] believes the malware has infected tens of thousands of routers and other IoT systems around the world. Yet, in the two months that the security vendor has been tracking Linux.Wifatch it has not seen the malware tool being used maliciously even once.

Proof of one of my favorite sayings: not everyone in the world is an asshole.
Perhaps it will steal from the rich and give to the poor.
Sounds too good to be true!
ROTFL!!!
Thanks, a little good news sure brightens up the day!
A true trojan most likely. It will strike when you least expect it.
“… it has not seen the malware tool being used maliciously even once.”
Oh, but you will!
Why dig a tunnel if you never plan to use it.
Tick tock, tick tock…
Morris worm, at least, predates it by.. a fair bit. Could be earlier others too…
No one has mentioned it;
so I will..
Anyone using Linux knows that if a hacker tries to hack a Linux user,
He will probably get the shaft in his own backdoor.
The Hacker will become the Hackee..
Or proof that it’s waiting for a particular date to strike havoc.
Been tried before, always gets corrupted before too long.