KadNap Inbound SSH Blocking (iptables)

Tim Peck@timpeck

•updated Mar 12, 2026•1•0•38

Detects the use of iptables to drop incoming SSH traffic (port 22). This is a tactic used by the KadNap malware via its 'fwr.sh' script to prevent administrative access and secure its foothold on an infected device.