[Intel]: https://sysdig.com/blog/ssh-snake/

[timb-machine]

Area

Malware reports

Parent threat

Defense Evasion, Discovery, Lateral Movement

Finding

https://sysdig.com/blog/ssh-snake/

Industry reference

attack:T1021.004:SSH
attack:T1078:Valid Accounts
attack:T1552.004:Private Keys
attack:T1027:Obfuscated Files or Information

Malware reference

#791
SSH-Snake

Actor reference

No response

Component

Linux, AIX, Solaris, HP-UX

Scenario

Internal enterprise services