What Attackers Usually Do First After Getting SSH Access

Most Linux compromises don’t start with destruction.