Do Son Attackers infected 333 Tor exit nodes with Ebury malware to hijack SSH logins and steal passwords. See how a researcher exposed them.
OpenSSH backdoor
Velvet Ant ran Operation Highland for nearly a decade, backdooring PAM and OpenSSH to hide inside an isolated critical infrastructure network.