New SSH-Snake malware steals SSH keys to spread across the network

Sysdig researchers discovered SSH-Snake, a self-modifying, open-source bash worm that searches compromised systems for SSH private keys (including via shell history and common key locations), strips down its code for stealth, and uses harvested credentials to move laterally; analysts found a C2 storing stolen credentials and evidence of initial access through Confluence vulnerabilities, with roughly 100 victims observed.