SSH

GoSerpent backdoor attacks in Southeast Asia
OkoBot framework infection chain | Securelist
Wireshark
Non-interactive SSH attacks dominate after login