Netskope Threat Labs

SSHDoor

ATP Sandbox Adv. HeuristicsAV

SSHDoor is a backdoored SSH daemon for Linux that steals passwords as users authenticate, giving its operators durable credentials on compromised servers.

First seen
May 2023
Last seen
October 2026
Sshdoor
Alert Name
Linux.Backdoor.Sshdoor
Linux.Backdoor.SSHDoor
Linux.Trojan.SSHDoor
Trojan.Linux.SSHDoor.7
Trojan.Linux.SSHDoor.9