Web server hackers install rogue Apache modules and SSH backdoors, researchers say