Attacks Against Linux SSH Services Detected by AhnLab EDR

AhnLab reports persistent attack campaigns against exposed Linux SSH services where attackers scan for open SSH ports, use brute-force and dictionary attacks to gain access, and then deploy malware (e.g., Kinsing coinminer) that performs scanning, propagation and lateral movement using harvested SSH keys; the report describes the attack chain and illustrates how AhnLab EDR detects login failures, suspicious SSH command execution, and file accesses related to propagation.