SSH-Snake: New Self-Modifying Worm Threatens Networks

The Sysdig Threat Research Team (TRT) discovered the malicious use of a new network mapping tool called SSH-Snake that was released on 4 January 2024. SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network. The worm automatically searches through known credential locations and shell history files to determine its next move. SSH-Snake is actively being used by threat actors in offensive operations. 

SSH-Snake activity can be identified by …

called compromised credential credentials january january 2024 malicious mapping network networks research searches snake ssh start sysdig system team threat threat research tool worm