I don't know why this is being called a backdoor, it's not. The fact that they're replacing the web server binary may be of consequence, but it's only one of many possible things the hackers could have done once root was compromised. The MOST important thing here is HOW root was compromised. Everything beyond that point is not really worth discussing. And any admin worth their salt and that cares about their servers is monitoring the checksums on their server binaries and would have picked up this binary change in a flash.