"Hide and Seek" Becomes First IoT Botnet Capable of Surviving Device Reboots

"But a new strain of malware, dubbed "Hide n Seek," can live through a power-cycle: it writes a copy of itself to the /etc/init.d/ directory in the IoT device's embedded GNU/Linux system, where startup programs are stored. When a device that's been infected this way is rebooted, it is freshly infected."

https://www.bleepingcomputer.com/news/security/hide-and-seek-becomes-first-iot-botnet-capable-of-surviving-device-reboots/