Attackers Exploit *sshole Vulnerability to Breach Linux Systems
Greynoise reports that the group GT10 is actively using the flaw to install a backdoor named TAC Agent on devices in Southeast Asia.
By Harper Collins ·
A critical vulnerability in Linux systems is being actively exploited to grant hackers privileged access, according to multiple security researchers. The flaw, identified as *sshole, arises from the interaction between OpenSSH and the musl code library. Systems running both components can be compromised by unauthenticated attackers within seconds, granting them control over high-privilege accounts.
*sshole became publicly known on Thursday, November 5, sparking immediate concern about widespread system compromise. By Monday, November 9, those fears were materializing as attackers launched coordinated campaigns against exposed infrastructure. The rapid timeline between public disclosure and active exploitation underscores the urgency for administrators to patch affected servers.
Security firm Greynoise reported on Monday that its honeypots in Southeast Asia were targeted by a group it tracks as GT10. The firm described the attacks as mature intrusions, indicating a sophisticated approach to breaching the systems. Greynoise subsequently gained access to a GT10 server, which provided insight into other potential victims and the specific tools deployed in the campaign.
The backdoor used by GT10 contains Chinese language comments and appears to be generated with AI assistance. The tool, tracked under the name TAC Agent, enables a range of functions including shell command execution, system reconnaissance, and persistence on the infected machine. GT10 also installs the Python3 release on machines that lack it, a dependency required to run the TAC Agent payload.
OpenSSH has released a fix that prevents the attack vector from working. Administrators of Linux systems relying on the musl library should apply the update immediately to mitigate the risk of unauthenticated access.
