Ebury: Linux SSH Backdoor, Credential Theft and Infrastructure Risk

Ebury is a long-running Linux OpenSSH backdoor and credential-stealing malware family documented by ESET and other investigators. The malware has been associated with server compromises and SSH interception, including historical cryptocurrency-related abuse. In October 2026, one Tor relay operator reported identifying Ebury 1.8.3 on two examined machines while investigating malicious exit behavior. That finding is not proof that Ebury infected every relay observed redirecting SSH traffic, or that cryptocurrency theft occurred in the 2026 Tor incident. ryo.news uses the case to examine endpoint integrity, operator key management and the boundary between anonymous routing and authenticated remote access.