Ebury is a Linux malware family associated with OpenSSH, credential theft, and persistent unauthorized access. It can target systems or SSH-related components to capture authentication data, helping attackers retain access or use stolen credentials to reach other machines.
It matters because SSH often provides administrative access to servers, so compromised credentials can enable wider intrusions. In attacks, Ebury may be deployed as a backdoor or used to steal credentials; defenders should monitor SSH binaries and libraries for unexpected changes, review login activity and key files, and prefer key-based authentication with strong access controls. A report that Ebury was attempted does not, by itself, establish that it was successfully installed.