OpenSSH tarballs shipped trojan horse

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0172 Runtime backdoor
T0184 Harvesting sensitive information from files
T0209 Compromise package registry or CDN origin

supply-chain campaign

T0172 · Execution · Runtime backdoor

Backdoor/RAT payload documented by the cited sources.

T0184 · Credential Access · Harvesting sensitive information from files

Credential or wallet material targeted.

T0209 · Initial Access · Compromise package registry or CDN origin

Distribution origin hosted the trojanized artifact.

Sources

https://www.openssh.com/txt/trojan.adv
https://marc.info/?l=bugtraq&m=102821663814127&w=2
https://blog.isosceles.com/openssh-backdoors/
https://groups.google.com/g/comp.security.announce/c/Y7V0PyvQXJ8
https://sourceware.org/legacy-ml/cygwin/2002-08/msg00102.html
https://undeadly.org/cgi?action=article&sid=20020801122759