Hackers actively exploit OpenSSH and musl flaw on Linux

Linux servers running specific software packages are under active attack. Researchers warn that hackers are using a critical flaw to log in as privileged users without credentials.

The vulnerability, identified as *sshole, exists in how OpenSSH interacts with the musl code library. On systems where both are present and certain conditions are met, attackers can gain unauthenticated access to high-privilege accounts within seconds.

The flaw became public last Thursday. Four days later, security firm Greynoise reported that its honeypots in Southeast Asia are being targeted by a group it tracks as GT10. Greynoise described the activity as mature intrusions.

Greynoise later gained access to a server operated by GT10. This exposure revealed potential additional victims and the tools used in the campaign. The attackers deployed a backdoor containing comments written in Chinese. The code appears to have been generated with AI assistance.

The group is installing the Python3 release on machines that lack it. The package is required to run the backdoor, which is tracked as TAC Agent. TAC Agent supports executing shell commands, conducting system reconnaissance, and maintaining persistence on compromised systems.

OpenSSH has released a fix that stops the attacks from working.