Let's be honest''your Linux server isn't the fortress you hope it is if your SSH setup isn't locked down tight. Recently, security teams have been tracking a spike in attacks, and it's not just the usual malware game we've seen before. Attackers are going low-key and crafty, exploiting weak SSH security to install legitimate tools like TinyProxy and Sing-box to turn compromised servers into proxy nodes. These tools are completely normal when used properly, but they're a dream for attackers who want to hide their tracks or sell access to your system.

Source: SSH Under Siege: Hardening Your Linux Server Against Proxy Abuse