Linux maintainers were infected for 2 years by SSH-dwelling backdoor with huge reach

Linux maintainers were infected for 2 years by SSH-dwelling backdoor with huge reach

 

See also ESET article:
Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain
14 May 2024 - by Marc-Etienne M.Léveillé
https://www.welivesecurity.com/en/e...rvers-compromised-cryptotheft-financial-gain/

Read there more for analysis with .pdf document.

 

So much for Linux systems being way more secure. Turns out that you indeed need to protect them, just like you would with Windows.

 

It looks like credential stealing/stuffing is the root cause, since then the perpetrators can gain root access with authentic credentials to install the malware. This is where 2FA, stronger passwords with frequent changes, and not falling for phishing scams should help to avoid these attacks.

 

Yes, but what about when malware is already running on Linux? Seems like you still need AV/EDR in order to spot this stuff. I'm guessing that these Linux servers simply aren't monitored for malware activity.

 

That seems to be the case here.