SSH-Snake, a network mapping tool, has been adapted by hackers to stealthily find and use private SSH keys for lateral movements in targeted networks. Identified by Sysdig as a self-altering worm, it diverges from standard SSH worms by avoiding predictable attack patterns. Launched on January 4, 2024, it’s a bash script that self-modifies to minimize detection, scanning directories, shell histories, and system logs to find SSH credentials. Sysdig confirmed its use after detecting a C2 server storing data from around 100 victims, indicating the exploitation of Confluence vulnerabilities for access. SSH-Snake represents a significant evolution in malware, exploiting the widely used SSH protocol in businesses.
At the very least keys without passphrases (such as for automated tasks) should restrict what commands can be run, should not give access to an interactive shell, and should go to a very specific user with as little file system access as is necessary to do the task. If an automated ssh task is giving access to the places you put your private keys and bash history, you’re probably doing something very wrong.