“The observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions,” Ryan Dewhurst, founder and CEO of Previdian, said in a statement shared with The Hacker News.

Affected users are advised to install OpenSSH 10.6p2 or their distribution’s patched package, and then restart sshd. Alpine is also recommending that users investigate “Accepted password for” log entries involving accounts that should not accept password logins.

“Look in /var/log/messages for sshd lines reading Accepted password for an account that has no password (alpine, root, or any key-only user),” Alpine said. “Review doas use and recently created users, files and authorized keys on exposed machines. If you cannot rule out a login, treat the machine as compromised.”