Exploited SSH Servers Offered in the Dark web as Proxy Pools

Aqua Nautilus researchers detail an active campaign abusing compromised SSH servers in cloud environments: attackers (often via brute-force or lateral SSH movement) convert instances into proxy nodes using SSH tunneling to relay SMTP and other traffic for spam, fraud, cryptomining, and intelligence collection. The report documents large-scale automated activity observed in honeypots (~1,000 attacks/day on a single honeypot), examples of malicious behavior and domains contacted, and provides detection and mitigation guidance (strong authentication, MFA, disabling TCP forwarding, log monitoring, patching).