Ebury botnet malware infected 400,000 Linux servers since 2009

ESET reports that the Ebury Linux botnet has compromised roughly 400,000 Linux servers since 2009 (about 100,000 still infected as of late 2023). Operators target hosting providers and their clients via credential stuffing and supply-chain techniques, steal SSH keys and intercept SSH traffic using ARP spoofing, and deploy kernel- and user-space modules (DGA-enabled, obfuscated) to exfiltrate credentials, redirect traffic, send spam, and steal cryptocurrency and payment data.