“Out of 4.8 million known_hosts entries collected by Ebury operators, about two million had their hostname hashed. 40% (about 800,000) of those hashed hostnames were guessed or brute forced.”
Ebury has run for 15 years, and roughly 100,000 servers were still infected in late 2023. The way in is credential stuffing, then stolen SSH keys and known_hosts files to hop to the next box. The operators target hosting providers, so one breach spreads to every customer renting a virtual server there. Hashing your known_hosts file stopped the attackers 60% of the time.