400K Linux Servers Recruited by Resurrected Ebury Botnet

Ebury is a long-lived OpenSSH backdoor botnet that has backdoored nearly 400,000 Linux, FreeBSD, and OpenBSD servers (with 100,000+ still compromised as of late 2023). Operators use credential theft, zero-day server software exploits, and credential reuse to spread across hosting providers and data centers, deploy secondary modules (HTTP backdoors, spam bots), and intercept SSH sessions to steal cryptocurrency wallets and credit card data; ESET published updated research, detection/remediation tools, and ongoing law-enforcement collaboration.