tag: Ssh-Backdoor · 3 items
- Engineer — Act: A trojanized Claude Code extension targeting Cursor/VS Code installs a persistent SSH backdoor on developer machines — audit all installed IDE extensions for this package and follow Microsoft’s remediation steps to remove backdoor artifacts and rotate any credentials accessible from affected workstations.
- SOC/IR — Act: Microsoft’s analysis includes detection guidance; sweep developer endpoints for the malicious extension presence and hunt for anomalous outbound SSH connections or new authorized_keys entries on workstations since late October 2026.
- Leader — Act: A supply-chain compromise of developer tooling with persistent backdoor access is a same-week risk event — confirm whether engineers use Cursor/VS Code extensions from untrusted sources, assess any exposure, and consider a brief to engineering leadership on extension vetting policy.
- Engineer — Act: If you use Cursor with the Claude Code extension, check whether you installed or updated it during the ~11-hour window on Oct 29; audit ~/.ssh/authorized_keys for unrecognized keys and rotate credentials accessible from the potentially compromised machine.
- SOC/IR — Act: Sweep developer workstations for unauthorized SSH authorized_keys entries added around Oct 29 and hunt for outbound beacon activity from machines running Cursor; prioritize developers with access to production systems or CI/CD pipelines.
- Leader — Act: Determine whether developers in your org use Cursor with the Claude Code extension; if so, direct an immediate sweep and assess whether compromised dev machines had access to sensitive systems or source code — this is the kind of developer-tooling supply-chain incident that can cascade into broader breaches.
- Engineer — Act: If your team uses the Claude Code extension on Cursor, audit all affected machines for version 2.1.313, check ~/.ssh/authorized_keys and running SSH tunnel processes for unauthorized entries, and rotate any credentials accessible from those developer workstations.
- SOC/IR — Act: Hunt across developer endpoints for the malicious extension version 2.1.313 and sweep for unauthorized SSH key additions or anomalous outbound SSH sessions from developer machines since the update was distributed; treat any hit as a potential persistent-access incident requiring IR.
- Leader — Act: Determine whether any engineers in your organization use the Claude Code extension on Cursor; if so, initiate an IR review — a supply-chain compromise on developer tooling means potential persistent access to source code, secrets, and cloud credentials, which warrants a leadership brief before it surfaces externally.