This report on the “Chaos” malware suite https://arstechnica.com/information-technology/2022/09/never-before-seen-malware-has-infected-hundreds-of-linux-and-windows-devices/ contains an interesting snippet:

A reminder to small office router owners everywhere: Most router malware can't survive a reboot. Consider restarting your device every week or so.

Seems like server-based malware is predominantly running entirely from RAM these days, to avoid leaving any forensic traces in the filesystem. But you can use this characteristic against them, since a simple reboot becomes enough to clear the infection.