In relation to SSH peculiarities such as a great number of outgoing SSH connections apparently involved in attacks and one SQL injection attack (outgoing) what does the collective intelligence think of this SSH rootkit: Ebury.
White Paper: http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.p... Article: http://www.welivesecurity.com/2014/03/18/attack-unix-operation-windigo/
Robert