Hackers are actively exploiting a critical security flaw dubbed "*sshole," which stems from the interaction between OpenSSH and a code library known as musl, according to multiple researchers. This vulnerability allows unauthenticated access to high-privilege accounts on affected Linux systems in a matter of seconds. Publicly disclosed last Thursday, the flaw immediately raised concerns about widespread compromise across Linux machines, and four days later, these predictions show signs of becoming real.
Security firm Greynoise reported on Monday that honeypots it maintains in Southeast Asia have been targeted by an attack group they track as GT10. The group executed "mature intrusions" into these systems, which Greynoise operates to detect attempted and successful attacks in real time.
Following these intrusions, Greynoise successfully gained access to a GT10 server. This server revealed potential other victims as well as some of the specific tools being deployed in the ongoing campaign. Notably, a backdoor utilized by the group in these attacks contains Chinese language comments and appears to be generated with the use of artificial intelligence.