Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain

ESET researchers report that the Ebury campaign continues to compromise hundreds of thousands of Linux servers (≈400,000 historical, >100,000 active as of late 2023) using an OpenSSH backdoor, credential stealing, ARP spoofing AiTM attacks, and additional malware families to steal cryptocurrency and financial data; the threat has evolved with obfuscation, a new DGA, and a userland rootkit, and ESET provides IOCs and detection resources.