Operation Poisson: OpenSSH Backdoor Install + Non-22 Port sshd Start + authorized_keys Write

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects anomalous SSH daemon (sshd) activity characterized by the installation or execution of a non-standard sshd binary (often located in /tmp or /var/tmp) or the execution of sshd with suspicious command-line arguments (custom ports or custom configuration files), followed by modifications to the authorized_keys file. This behavior is indicative of unauthorized persistence or backdoor access.