GT10 exploits sshole to take over Linux systems

A flaw dubbed *sshole lets an unauthenticated attacker log into a high-privilege account on many Linux systems in seconds. It comes from the way OpenSSH interacts with musl, the small C standard library used by Alpine and other size-conscious distributions. A system has to run both packages, and meet some further conditions, to be exposed. The ones that qualify can be taken over with no credentials at all.

The bug went public last Thursday. The immediate concern was that it would lead to widespread compromise of Linux machines, and four days later that prediction was starting to show signs of becoming real. Greynoise reported that honeypots it runs in Southeast Asia were being hit by a group it tracks as GT10. It called the activity “mature intrusions,” which is to say deliberate hands-on operations rather than noisy mass scanning.

Greynoise then gained access to one of GT10’s own servers. That box listed potential other victims and held some of the tooling used in the campaign. The backdoor the group installs, tracked as TAC Agent, carries Chinese-language comments and appears to have been generated with the help of AI. It runs on Python3, and GT10 installs the Python3 runtime on any target that lacks it so the backdoor will execute. Once running, TAC Agent handles shell commands, system reconnaissance, and persistence.

OpenSSH has released a fix that prevents the attack from working, so patching the SSH server closes the hole directly. The exposure is specific to the OpenSSH plus musl combination, so the hosts to check first are the minimal, Alpine-style images and appliances where musl is the libc rather than glibc.

On the detection side, GT10’s habit of installing Python3 to run its backdoor gives you a usable signal: a Python3 runtime appearing on a host that was deployed without one, especially a stripped-down container or appliance, is worth treating as a compromise until proven otherwise.