@absturztaube @mizuki
The main module attempts to spread to other known hosts by stealing the client-side certificates and connecting to them without the requirement for a password.
...
The actor employs various methods to spread across the network, like harvesting client-side certificates for spreading to known hosts using ssh, or spreading to systems with an incorrectly configured Docker API.