RotaJakiro: A long live secret backdoor with 0 VT detection

The first meaning is what you describe: something malicious stealthily implanted into an otherwise-legitimate or thought-to-be-legitimate application or appliance.

The other meaning covers any method of secret access persistence on a compromised system (generally a host, like a server). This could be something like a bash script that launches a reverse shell when you login, a malicious kernel module that extracts and executes arbitrary C code if a specific pattern is detected in network traffic, or just about anything imaginable. And you could also achieve it with the former definition.

I think among the infosec community, it's indeed more common for "backdoor" to refer to the former and a general term like "persistence" / "persistence mechanism" (though that can potentially refer to anything malicious that persists), or sub-categories like "foothold", to refer to the latter. "Backdoor" for the latter wouldn't be a misuse, though.

There's also a possible looser third definition, where lazy / fearmongering anti-virus companies sometimes like to label almost any kind of malware a "backdoor" or "backdoor trojan", perhaps because that carries more frightening implications for end users than a term like "virus" or "malware". It somewhat overlaps with the second definition, but I think it's rare a technical person would use it that way; it's less rare that a technical person might use the second definition.

The kernel any OS including linux runs is not source only at all, it's compiled, maybe by the user from source or by a redistributor which then passes it in compiled form to your system.

Furthermore this malware seem to not mess with the kernel, but pretend to be a normal system service.

ELF means Executable and Linkable Format, it's the executable format which Linux binaries use (and not just them). E.g. a shared library (Linux version of DLL) is in elf format. A variation of ELF is also used by UEFI but that doesn't seem to matter in this article.

So basically someone or something hacked their system and installed this malware or they where tricked into installing it themself.

The fact that the involved files where named in ways which totally could be normal parts of the system didn't help (but is also common, so I wouldn't say it made it harder).