CVE-2026-33017 isp.sh SSH Worm Lateral Movement via SSH Keys and Agent

Ethan Andrews@eandrews

•updated Jun 23, 2026•1•0•1

Detects the SSH worm component of the isp.sh dropper used in the CVE-2026-33017 Langflow cryptominer campaign. The worm enumerates local SSH private keys (id_rsa, id_ed25519, id_dsa), parses known_hosts, queries SSH_AUTH_SOCK for agent-loaded keys, and spreads via SSH and SCP with BatchMode=yes and StrictHostKeyChecking=no to avoid interactive prompts during lateral movement.