On: We may have witnessed a NSA "Shotgiant" TAO-like a...

[gwu78]

It seems hard to believe someone doing something like this would not at least try to cover their tracks.

  export HISTSIZE=0?

And how do you know these were unmodified versions of netstat, who and ps that you ran?

Do they have mtree in this OS?

I'm no security expert but this little story just sounds very unsophisticated given the seriousness you are attributing to it.