A security analyst notices that a workstation's antivirus reports no infections, yet specific system files appear normal to the OS while a separate forensic boot disk reveals hidden processes and altered kernel modules. Network monitoring also shows periodic beaconing that does not appear in the host's own connection logs. Which type of malware best explains these indicators?