Cybercriminals Weaponizing Open-Source SSH-Snake Tool for Network Attacks

The report warns that SSH-Snake, originally an open-source network-mapping tool, has been repurposed by attackers into a fileless, self-replicating SSH worm that harvests SSH keys, credentials and command histories to map and traverse networks; observed deployments followed exploitation of known flaws in Apache ActiveMQ and Atlassian Confluence. It also highlights a separate Lucifer botnet campaign abusing misconfigurations and vulnerabilities in Apache big-data components (Hadoop, Druid, Flink) to enlist hosts for cryptomining and DDoS operations.