Lazarus SSH Private Key Exfiltration via Developer Process with Outbound Connection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where scripting or development processes (e.g., node.exe, python.exe, code.exe) access sensitive SSH private key files or PEM files, followed by an immediate outbound network connection to a non-private IP address within 60 seconds. This activity is indicative of credential exfiltration or unauthorized use of stolen keys.