Anomali Cyber Watch: SSHole Zero-Day & TraderTraitor Hack

A password authentication bypass in OpenSSH, tracked as CVE-2026-123158 and nicknamed “SSHole,” was disclosed and patched on November 5, 2026, after being reported by researcher Özgün Kültekin. Rated 8.1 on the CVSS 3.1 scale, the flaw affects OpenSSH on Linux systems using musl libc without PAM (Pluggable Authentication Module), including Alpine Linux, OpenWrt, Buildroot, and Yocto. The vulnerability stems from three separate design decisions: musl’s password-hashing function returns an asterisk (*) when given a password longer than 256 bytes; a 2016 OpenSSH change introduced a code path that evaluates that return value; and certain accounts on affected systems legitimately store * to indicate no password is set. When these conditions align, submitting a password between 257 and 1,024 bytes causes the hashing function to fail and return *, which OpenSSH incorrectly matches against the account’s stored * and grants login with no valid credentials required. On Alpine’s official AWS and Azure cloud images, this gives an attacker access to the default alpine user, which holds passwordless administrative privileges sufficient to obtain root access. OpenSSH 10.6p2 fixes the flaw by rejecting stored values too short to represent a valid password hash; Alpine patched all branches back to version 3.16, including end-of-life releases. Exploitation in the wild began less than nine hours after disclosure, with attempts logged from at least 12 unique IP addresses across 8 countries by November 8, 2026.

Source

Analyst Comment

The immediate patching action is straightforward; the harder problem is knowing whether you are exposed. Alpine and other musl-based images are common in container pipelines and CI/CD infrastructure, often adopted without formal documentation and rarely inventoried with the same rigor as production servers. Organizations that do not actively track their container base images should treat that gap as the first priority. Where exposure is confirmed in build or pipeline environments, the risk extends beyond the affected host: a compromised CI/CD runner can expose SSH keys, API tokens, cloud credentials, and database passwords reachable from that environment, and may provide a foothold for lateral movement into production systems. Rebuilding container images is a more demanding remediation step than patching a running server; organizations should assume this is where deferred remediation will concentrate and prioritize accordingly. The standard detection signal is a failed authentication attempt followed by a successful password login on a password-disabled account within the same session. That signal is reliable only where sshd logs are collected and retained. Ephemeral containers and short-lived runners are frequently unmonitored at this level, so absence of a log entry cannot be treated as evidence of absence. Exploitation was observed within hours of both CVE disclosure and public PoC availability, consistent with opportunistic scanning; the patching window should be treated as already closing.

North Korean threat actor TraderTraitor stole $6.34 billion in digital assets from Binance in a multi-stage attack spanning June through October 2026. The campaign began with a supply chain attack: a malicious search ad led a wallet DevOps engineer to install a trojanized Homebrew package, exposing wallet team engineer identities despite Binance containing the breach. In September, attackers posing as recruiters built trust through a fabricated multi-round interview before instructing a second engineer to clone a malicious code repository onto his work computer. The zero-day malware evaded endpoint security by replacing a legitimate Python version manager with a malicious copy, establishing command-and-control. By October 20, the attacker had pivoted through a compromised internal AI tool to access two additional wallet engineers, obtaining a container deployment token. On October 29, using stolen credentials and that token, the attacker reached Binance’s wallet signing service and transferred 233.46 million XRP, 970,500 SOL, 44.2 million OP, and 18,270 BTC, then exploited EIP-7702, an Ethereum feature that delegates execution rights to a smart contract, to sweep approximately 200,630 ETH and billions in stablecoins. Binance has frozen approximately $2.85 billion in assets, will cover all remaining losses, and the FBI attributed the attack to North Korea.

Source

Analyst Comment

The structural story here is not the attack techniques: it is the adversary’s persistence and adaptation against a specific target. Binance’s own disclosure notes 57 suspected North Korea-linked cases detected and blocked across 2026; the September campaign succeeded regardless, by targeting a different engineer through a different vector, likely using intelligence the attacker had already extracted from the June incident. Successful containment did not eliminate the threat; it closed the technical breach while the attacker retained targeting knowledge and adapted. For defenders, the most transferable lesson is toolchain integrity: standard endpoint protection does not reliably detect trusted developer binaries being replaced by malicious copies, and developer machines warrant elevated scrutiny precisely because they typically carry access to production infrastructure. Organizations should also note that this incident demonstrates internal AI tools can serve as lateral movement enablers; the specific access and mechanism in this case are not fully disclosed by Binance, but the risk category warrants review of what those tools can reach within your environment.

A threat actor published backdoored versions (2.1.312 and 2.1.313) of Anthropic’s Claude Code extension to Cursor’s extension marketplace on October 29, 2026, live from 2:27 AM to 1:35 PM PT. How the attacker gained publishing access has not been disclosed; Anthropic confirmed its own systems were not compromised. Developers with auto-update enabled received the malicious code without any prompt. The backdoor collected hostname, username, OS, architecture, home and working directories, Git email, public IP, and names (not values) of environment variables matching credential patterns including KEY, TOKEN, SECRET, PASS, AWS, and GCP. It attempted to install an attacker-controlled SSH key labeled “svc-telemetry” in authorized_keys, enable the local SSH service, and open a reverse tunnel to 134.209.82.225 on port 22. Persistence was established via a LaunchAgent on macOS, a crontab @reboot entry on Linux, or a SYSTEM-level scheduled task on Windows, retrying every 60 seconds. Host details and backdoor status were reported via HTTP POST to port 8099 at the same IP, independent of SSH outcome. The SSH-enabling step failed on most systems due to insufficient privileges, though the key and persistence artifacts were still written. Cursor estimates approximately 5,000 developer systems were affected. No threat actor has been identified.

Source

Analyst Comment

The collection of environment variable names rather than values suggests SSH tunnel access was likely the primary objective, with the beacon serving as a triage mechanism to identify high-value targets for manual follow-up. That framing matters for exposure assessment independent of whether the SSH step succeeded. Privilege constraints limited interactive access on most systems but did not prevent key planting, persistence writing, or beaconing. Least-privilege reduced the worst outcome without blocking the initial foothold. Remediation should be scoped accordingly: where SSH likely failed, documented artifact removal is credible; where Cursor ran with administrator privileges and SSH may have succeeded, interactive access cannot be ruled out and reimaging is the defensible response. Uninstalling the extension does not constitute remediation in either case. Cursor’s estimate of approximately 5,000 affected systems is based on download counts; the attacker’s actual inventory derives from beacon data defenders cannot access, so the figure should be treated as contextual. Detection required telemetry most organizations do not apply to developer workstations: authorized_keys monitoring, visibility into new LaunchAgents and scheduled tasks, and network egress capable of identifying outbound SSH to 134.209.82.225. Organizations should review whether auto-update on developer tooling is an acceptable default.

HYFLOCK is a Ransomware-as-a-Service (RaaS) operation first promoted through underground forums in late March 2026, with affiliate recruitment beginning in May, advertising shared negotiation tools, automated revenue splitting, and access procurement support. Researchers traced four ransomware generations between April and October, all sharing a consistent Rust/Nishi core. July retained the April architecture behind a delivery loader; October introduced the first substantial changes. The October 17 build staged itself under an EdgeUpdate-themed directory, registered a scheduled task, performed administrative-share processing, and confirmed encryption of 17 files, with 500 successful file renames, using AES counter-mode encryption, with symmetric key material protected by 4,096-bit RSA. A fail-open design allows encryption to continue if key backup fails, potentially blocking recovery even after payment. Two encryption weaknesses were identified: an earlier October build contains a defect capable of permanently discarding portions of file data; the October 17 build encrypts only the first 4,096 bytes of larger files, allowing recovery of 73 internal components from seven encrypted Office files without a key. No complete files were restored and no general decryptor exists. HYFLOCK’s first public batch of eight victim claims appeared October 13 across manufacturing, business services, government, retail, and telecommunications. Domain-wide propagation and post-RDP-session execution remain unverified.

Source

Analyst Comment

HYFLOCK’s progression from underground promotion to public extortion across four malware generations in roughly six months indicates sustained development aimed at expanding operational capability. Victim claims have continued beyond the initial October 13 batch, although the claimed compromises have not been independently established in the cited research. The observed behaviors largely reflect established ransomware techniques, including scheduled task abuse, software-update-themed staging, administrative-share processing, and attempted recovery inhibition, and are worth hunting regardless. The operationally critical finding is recovery variability. The two October builds produce materially different outcomes, ranging from partial content recovery to potential permanent data loss, and that difference depends on the specific build involved. Responders should preserve encrypted files and execution artifacts before wiping systems, as recovery opportunities depend on the encryption behavior and any surviving evidence from the original execution. The fail-open encryption design adds further complication: encryption continues even when key backup fails, meaning payment may not guarantee a working decryptor. No initial access vector was established in this investigation, leaving no specific entry point to prioritize against HYFLOCK. Detection should focus on EdgeUpdate-themed staging paths, unexpected scheduled tasks, attempted shadow-copy deletion, and mass .locked extension renames, correlated with surrounding behavior rather than treated as standalone indicators.

A malware campaign distributing trojanized GitHub repositories has operated for approximately two years, with researchers reporting more than 2,000 Windows systems compromised. Initially targeting cryptocurrency users through blockchain game repositories, the campaign has shifted focus to security professionals, with lures mimicking utilities for network scanning, security testing, and log analysis. Visual Studio .csproj files use PreBuildEvent routines to run malicious code before compilation; .suo files carry embedded PowerShell commands; Python and Go files conceal malicious code behind extensive whitespace. A PowerShell script (PowerShell.Packed.270) queries legitimate platforms including Pastebin, YouTube, and Google Docs, retrieving an encrypted string that decrypts to a download location for an archive containing the Electron-based loader designated Trojan.Loader.3261. The loader disables Windows Defender, UAC, System Restore, and VSS; its Mode3 path applies six evasion techniques: PPID spoofing, Smart App Control bypass, ntdll.dll unhooking, direct syscall execution, ETW patching, and AMSI patching. Final payloads include two instances of BackDoor.AsyncRAT.115 configured on separate ports, clipboard hijacker Trojan.Clipper.688 replacing cryptocurrency wallet addresses, and infostealer JS.Stealer.191, which exfiltrates browser data, FTP configuration files, VPN settings, and Discord tokens via Telegram. The malware attempts to remove ESET, McAfee, and Malwarebytes, modifying the hosts file to make antivirus vendor domains inaccessible.

Source

Analyst Comment

The targeting pivot from cryptocurrency users to security professionals demonstrates adaptation to the tooling interests of the intended audience. Lures built around Fscan parsers and security testing utilities show familiarity with what security professionals use in practice. The campaign exploits trust in GitHub, where building an unfamiliar Visual Studio project or executing sourced Python or Go code can trigger malicious activity before the risk is apparent. Mode3 employs AMSI and ETW patching alongside ntdll.dll unhooking to interfere with endpoint inspection during payload deployment, reducing visibility into specific process activity. These techniques do not eliminate all telemetry, making earlier execution-stage detection particularly valuable, including unexpected PowerShell spawned from Visual Studio build processes, unexpected Defender exclusions, VSS modifications, and changes to VerifiedAndReputablePolicyState. Network monitoring for connections to published attacker infrastructure provides a complementary detection layer. On security and development workstations, the documented targeting of VPN configurations, browser data, and application credentials creates a potential pathway to broader organizational access. Externally sourced tools should be reviewed and tested in isolated environments without production credentials or unrestricted network access. The published IOC repository contains actionable indicators for retrospective and prospective detection.

A cyberattack affecting a refrigeration equipment provider disrupted cold storage monitoring and control systems at three regional facilities of the French Blood Establishment (EFS) overnight between November 1 and 2, 2026. EFS confirmed it was not directly targeted. Coolworld Rentals, identified in reporting as the affected provider, separately confirmed a cybersecurity incident involving remote monitoring software and stated the relevant vulnerability concerned a component supplied by a third party outside its direct control. The incident altered operating parameters at EFS cold rooms, raising temperature and defrost thresholds to very high levels. EFS monitoring and alarm systems detected the anomalies, allowing staff to secure affected equipment and transfer or secure stored products, including plasma for direct transfusions and plasma destined for fractionation in the manufacture of medicines. No blood products were lost, no health impact was identified, and collection and distribution continued without interruption. The incident coincided with a broader second wave of attacks against refrigeration systems across multiple European countries. EFS technical teams are working with France’s national cybersecurity agency (ANSSI) and the Ministry of Health. Attribution remains unconfirmed. NoName057(16) and Z-Pentest have claimed responsibility for the wider European refrigeration attacks, but those claims are unverified and no authority has publicly attributed the EFS incident to either group.

Source

Analyst Comment

The EFS incident demonstrates that an organisation’s operational security perimeter extends to every third party capable of accessing or controlling critical physical systems. EFS was not directly targeted, yet the compromise of a refrigeration provider was sufficient to threaten medically critical cold storage. Defenders should ask two questions that are frequently unanswered: who has remote operational access to our physical systems, and what security baseline do we require of them. Lupovis honeypot data indicates that between October 20 and 30, with a clear spike on October 26, exposed refrigeration controllers were systematically probed, consistent with reconnaissance preceding the November attacks, although no direct operational link between the probing and subsequent compromises has been established. The apparent focus on physical disruption rather than financial gain is notable. Public reporting reviewed to date has not identified ransom demands, extortion, or data theft associated with these attacks. While attribution remains unconfirmed, the unverified claims by NoName057(16) and Z-Pentest warrant attention. The US Department of Justice has previously described NoName057(16) as state-sanctioned and, according to a federal indictment, CARR, also known as Z-Pentest, as founded, funded, and directed by Russia’s GRU, illustrating how the hacktivist label can obscure more substantial state involvement without establishing responsibility for this specific incident.