[tor-relays] SSH scans from Tor exit

[I]

In relation to SSH peculiarities such as a great number of outgoing SSH connections apparently involved in attacks and one SQL injection attack (outgoing) what does the collective intelligence think of this SSH rootkit: Ebury.

White Paper: http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf
Article: http://www.welivesecurity.com/2014/03/18/attack-unix-operation-windigo/

Robert