Also see https://asec.ahnlab.com/en/54647/ which links to Ahnlabs more technical description. Seems like it breaks in by guessing passwords and trying to log in via SSH.

Sad that this article contains almost no information other than "malware attacks your ssh". Well... I guess I better buy their firewall if they're not telling me what to fix.