Active exploitation of OpenSSH “regreSSHion” bug surges mid‑week, defenders urged to tighten rate limits and patch
Marcus Webb ·
Attackers ramped up exploitation attempts against OpenSSH servers on Wednesday, targeting CVE-2024-6387, the “regreSSHion” vulnerability first disclosed in July 2024. The bug is a signal handler race condition in sshd that enables remote code execution before authentication on glibc based Linux systems. Internet telemetry and honeypot data show sustained scanning and exploitation bursts against public SSH endpoints across cloud providers.
The timing matters because the attack is probabilistic. Adversaries increase success by generating large volumes of short lived connection attempts, which means mid week surges are more likely to yield compromises when enterprise change windows leave instances exposed.
CVE-2024-6387 reintroduced logic flaws that had been mitigated in earlier releases. It affects OpenSSH on glibc based Linux distributions, while musl based distributions and OpenBSD are not impacted by the original flaw. OpenSSH 9.8p1 and vendor backports addressed the issue, but long lived images and appliances often lag updates.
Exploitation does not require credentials. Successful attackers commonly drop additional tooling and establish persistence by modifying authorized_keys, adding new users, and implanting cron entries or systemd units. Post exploitation activity observed on compromised hosts includes lateral movement with stolen SSH keys and deployment of commodity frameworks such as Cobalt Strike or Sliver.
Defenders can blunt active probing even before patching. Set MaxStartups to conservative values, for example 10:30:60, and reduce LoginGraceTime to 30 seconds to constrain incomplete handshakes. Apply network level rate limiting with nftables or iptables hashlimit rules and prefer port knocking or single packet authorization in front of bastion hosts.
Prioritize vendor patched OpenSSH builds or distribution security updates, then verify the running daemon version rather than only installed packages. Disable password authentication, require strong key based authentication, restrict SSH to management networks, and enforce multi factor on jump hosts. Monitor for unusual volumes of failed connections and for sshd crashes or core files that coincide with spikes in connection attempts.
Hunt for persistence and credential theft after any suspected exploitation. Audit authorized_keys and known_hosts, compare user and group membership to a baseline, and scan for unexpected systemd units or cron entries. Rotate keys that have ever resided on an exposed host, since key reuse enables silent lateral movement.
The broader impact is a reminder that remote management surfaces remain the highest risk services on the internet. Probabilistic preauthentication exploits favor adversaries that can scale traffic, which tilts the field toward botnets unless organizations combine rapid patching with aggressive rate controls and network segregation.