The Ebury malware botnet has been active since 2009, affecting over 400,000 Linux servers.

Approximately 100,000 of these servers remain infected by the Ebury malware.

Ebury primarily targets ISPs, hosting providers, and servers across different operating systems.

Operators gain server access through stolen credentials, Man-in-the-Middle (AitM) attacks, and leveraging zero-day exploits.

The malware has not only affected users but also compromised the infrastructures of other cyber threat groups.

Despite being operational for years, the Ebury malware continues to receive updates, making it a sustained threat to Linux security.