Threat intelligence / Technique

SSH

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).

31 recorded

Relationships

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Multi-factor Authentication

Mitigation

mitigates

from User Account Management

Mitigation

subtechnique-of

to Remote Services

Technique

uses

from APT39

Group

uses

from APT5

Group

uses

from Aquatic Panda

Group

uses

Group

uses

from C0032

Campaign

uses

from Cobalt Strike

Malware

uses

from Cutting Edge

Campaign

uses

Tool

uses

from FIN13

Group

uses

from FIN7

Group

uses

from Fox Kitten

Group

uses

from GCMAN

Group

uses

from Indrik Spider

Group

uses

Malware

uses

from Lazarus Group

Group

uses

Group

uses

from Leviathan Australian Intrusions

Campaign

uses

Group

uses

Group

uses

from Qilin

Malware

uses

Malware

uses

from Rocke

Group

uses

from Salt Typhoon

Group

uses

from Scattered Spider

Group

uses

from Storm-1811

Group

uses

Group

uses

Group

5 external

References

mitre-attack

T1021.004

Sygnia Abyss Locker 2025

https://www.sygnia.co/blog/abyss-locker-ransomware-attack-analysis/

TrendMicro ESXI Ransomware

https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html

Apple Unified Log Analysis Remote Login and Screen Sharing

https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins

Sygnia ESXi Ransomware 2025

https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/