lambsys SSH Key Harvesting and Lateral Movement via known_hosts

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the Lambsys cryptominer malware performing SSH credential harvesting by accessing user SSH keys (known_hosts, authorized_keys, id_rsa) with unauthorized processes, staging these files in temporary or hidden directories, and subsequently initiating outbound SSH connections for lateral movement, all correlated by process group ID.