Latest SSH news

Cisco warns of large-scale brute-force attacks against VPN services

Cisco warns about a large-scale credential brute-forcing campaign targeting VPN and SSH services on Cisco, CheckPoint, Fortinet, SonicWall, and Ubiquiti devices worldwide.
- Bill Toulas
- April 16, 2024
- 12:11 PM
- 2
PuTTY SSH client flaw allows recovery of cryptographic private keys

A vulnerability tracked as CVE-2024-31497 in PuTTY 0.68 through 0.80 could potentially allow attackers with access to 60 cryptographic signatures to recover the private key used for their generation.
- Bill Toulas
- April 16, 2024
- 11:01 AM
- 0
New SSH-Snake malware steals SSH keys to spread across the network

A threat actor is using an open-source network mapping tool named SSH-Snake to look for private keys undetected and move laterally on the victim infrastructure.
- Bill Toulas
- February 21, 2024
- 02:03 PM
- 2
Nearly 11 million SSH servers vulnerable to new Terrapin attacks

Almost 11 million internet-exposed SSH servers are vulnerable to the Terrapin attack that threatens the integrity of some SSH connections.
- Bill Toulas
- January 03, 2024
- 10:06 AM
- 0
Terrapin attacks can downgrade security of OpenSSH connections

Academic researchers developed a new attack called Terrapin that manipulates sequence numbers during the handshake process to breaks the SSH channel integrity when certain widely-used encryption modes are used.
- Bill Toulas
- December 19, 2023
- 12:03 PM
- 0
Researchers extract RSA keys from SSH server signing errors

A team of academic researchers from universities in California and Massachusetts demonstrated that it's possible under certain conditions for passive network attackers to retrieve secret RSA keys from naturally occurring errors leading to failed SSH (secure shell) connection attempts.
- Bill Toulas
- November 19, 2023
- 10:01 AM
- 0
ShadowSyndicate hackers linked to multiple ransomware ops, 85 servers

Security researchers have identified infrastructure belonging to a threat actor now tracked as ShadowSyndicate, who likely deployed seven different ransomware families in attacks over the past year.
- Bill Toulas
- September 26, 2023
- 05:11 AM
- 0
New proxyjacking attacks monetize hacked SSH servers’ bandwidth

Attackers behind an ongoing series of proxyjacking attacks are hacking into vulnerable SSH servers exposed online to monetize them through services that pay for sharing unused Internet bandwidth.
- Sergiu Gatlan
- June 30, 2023
- 02:47 PM
- 0
Hackers infect Linux SSH servers with Tsunami botnet malware

An unknown threat actor is brute-forcing Linux SSH servers to install a wide range of malware, including the Tsunami DDoS (distributed denial of service) bot, ShellBot, log cleaners, privilege escalation tools, and an XMRig (Monero) coin miner.
- Bill Toulas
- June 20, 2023
- 01:50 PM
- 3
Hackers use Azure Serial Console for stealthy access to VMs

A financially motivated cybergang tracked by Mandiant as 'UNC3944' is using phishing and SIM swapping attacks to hijack Microsoft Azure admin accounts and gain access to virtual machines.
- Bill Toulas
- May 16, 2023
- 08:57 PM
- 0
GitHub.com rotates its exposed private SSH key

GitHub has rotated its private SSH key for GitHub.com after the secret was was accidentally published in a public GitHub repository. The software development and version control service says, the private RSA key was only "briefly" exposed, but that it took action out of "an abundance of caution."
- Ax Sharma
- March 24, 2023
- 04:33 AM
- 0
FIN7 hackers create auto-attack platform to breach Exchange servers

The notorious FIN7 hacking group uses an auto-attack system that exploits Microsoft Exchange and SQL injection vulnerabilities to breach corporate networks, steal data, and select targets for ransomware attacks based on financial size.
- Bill Toulas
- December 22, 2022
- 08:00 AM
- 0
Hackers trojanize PuTTY SSH client to backdoor media company

North Korean hackers are using trojanized versions of the PuTTY SSH client to deploy backdoors on targets' devices as part of a fake Amazon job assessment.
- Bill Toulas
- September 15, 2022
- 04:45 PM
- 7
New Linux malware brute-forces SSH servers to breach networks

A new botnet called 'RapperBot' has emerged in the wild since mid-June 2022, focusing on brute-forcing its way into Linux SSH servers and then establishing persistence.
- Bill Toulas
- August 04, 2022
- 12:22 PM
- 0
New ‘Lightning Framework’ Linux malware installs rootkits, backdoors

A previously undetected malware dubbed 'Lightning Framework' that targets Linux systems can be used to backdoor infected devices using SSH and deploy rootkits to cover the attackers' tracks.
- Sergiu Gatlan
- July 21, 2022
- 05:42 AM
- 0
New peer-to-peer botnet infects Linux servers with cryptominers

A new peer-to-peer botnet named Panchan appeared in the wild around March 2022, targeting Linux servers in the education sector to mine cryptocurrency.
- Bill Toulas
- June 15, 2022
- 09:00 AM
- 0
Cisco Umbrella default SSH key allows theft of admin credentials

Cisco has released security updates to address a high severity vulnerability in the Cisco Umbrella Virtual Appliance (VA), allowing unauthenticated attackers to steal admin credentials remotely.
- Sergiu Gatlan
- April 21, 2022
- 04:16 AM
- 0
Kali Linux 2022.1 released with 6 new tools, SSH wide compat, and more

Offensive Security has released Kali Linux 2022.1, the first version of 2022, with improved accessibility features, a visual refresh, SSH wide compatibility, and of course, new toys to play with!
- Lawrence Abrams
- February 14, 2022
- 07:41 PM
- 0
Cisco fixes hard-coded credentials and default SSH key issues

Cisco has released security updates to address critical security flaws allowing unauthenticated attackers to log in using hard-coded credentials or default SSH keys to take over unpatched devices.
- Sergiu Gatlan
- November 04, 2021
- 01:24 PM
- 0
Microsoft revokes insecure SSH keys for Azure DevOps customers

Microsoft revoked insecure SSH keys some Azure DevOps have generated using a GitKraken git GUI client version impacted by an underlying issue found in one of its dependencies.
- Sergiu Gatlan
- October 12, 2021
- 08:00 AM
- 0