🧰 OpenSSH

The items that name it 10

• Malicious Claude Code extension on Cursor planted SSH backdoors
  articleas tools2026-10-30

  SSH server the malware tried to enable on Windows to make the reverse tunnel usable

• Using Claude to reduce the attack surface of code
  articleas classification.technologies2026-10-21
• Markakd/Container_escape
  repoas tools2026-09-16

  Used for generated SSH keys/access to the VM

• bikini/exploitarium
  repoas affected products2026-09-07It is written here as OpenSSH (agent lock provider bypass).

  agent lock provider bypass

• numasec
  repoas affected products2026-08-27

  example observed component used to illustrate the knowledge broker's vulnerability intelligence enrichment (KEV/EPSS)

• How the RaaS Business Model Actually Works
  articleas tools2026-07-01

  Used by attackers for persistence after compromising the SonicWall appliance in the Akira example

• State of Post Quantum Cryptography | Wiz Blog
  articleas affected products2026-05-28

  Version 9.0 (released April 2022) used non-NIST-standard sntrup761x25519-sha512; version 10.0 (released April 2025) is first to default to mlkem768x25519-sha256; does not currently support PQC for authentication; only 4.4% of instances observed use version >=10.0

• Orca Security: Critical Unauthenticated RCE in Kopia Backup via SSH ProxyCommand Injection
  advisoryas classification.technologies2026-05-26
• Unmasking an Attack Chain of MuddyWater
  writeupas tools2026-03-06It is written here as OpenSSH (ssh.exe).

  Used by the threat actor to establish SSH tunnels (C:\Windows\System32\OpenSSH\ssh.exe) for reverse port forwarding to attacker infrastructure

• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeupas tools2025-12-03

  Installed by threat actors alongside Velociraptor via msiexec (ssh.msi) in Incident 1; attempted to be used for reverse SSH tunneling in Incident 3