Ebury backdoors SSH servers in hosting providers, giving the malware extraordinary reach.

https://arstechnica.com/security/2024/05/ssh-backdoor-has-infected-400000-linux-servers-over-15-years-and-keeps-on-spreading/