lambsys SSH key reuse worm lateral movement from Langflow host

Ibrahim Saud@tektrix

•updated Jun 27, 2026•3•0•8

Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.