Got hit by the ops/sshd thing on Sep 2, source IP 82.192.72.4 (paramiko + a Go client). Trying to work out if I should treat this as compromised or not, because it looks like the exploit got in but the payload didn't run.
In the system log the only thing from that IP is failed logins for "-2":
Sep/02/2026 02:27:56 system,error,critical login failure for user -2 from 82.192.72.4 via ssh
Sep/02/2026 03:28:45 system,error,critical login failure for user -2 from 82.192.72.4 via ssh
No "user ops added", no ops login, no fetch upload. info logging is on (I see other info entries around then), so a user add would have shown up.
The @sshd part of the autosupout.rif shows the actual bypass though - unauth "-2", a forced rekey, and then it jumps straight to a channel + exec with no password:
auth req: -2 ssh-connection none
next auth methods: publickey,password
rekey
transport state: 4 --> 6
transport state: 6 --> 5
channel #0 opened 0 w:200000 p:8000
chan req: exec 1
cmd: :if ([:len [/user find where name="ops"]] = 0) do={/user add name=ops password=xxxx group=full} else={/user set [find where name="ops"] password=xxxx group=full}; :put ("OPS=".[:len [/user find where name="ops" and group=full]]); :put "__DONE_xxxx__"
channel #0 closed, left 0
killChild: pid not found: xxxxx
/bndl/security/nova/bin/ssh
--- signal=12 --------------------------------------------
So it reached exec, but every attempt ends the same way: killChild pid not found right after the cmd, and sshd crashes with signal=12 (full register dump in the rif). The follow-up Go client that's meant to log in as ops never authenticates either, it just gets dropped with . And it keeps retrying the same payload with a fresh DONE marker each time, which to me means it never got the OPS=1 confirmation back.
Only artifact on the box is the autosupout.rif files themselves, but those look like they're from the signal=12 crashes, not something ops uploaded. ops user isn't there, no unknown ssh keys, no unknown scripts/scheduler.
I'm guessing this is just a version mismatch and the exploit fell over before doing anything, but I'd rather not guess. Would you call this compromised or a failed attempt? And does anyone know if just reaching exec is enough to get flagged after the upgrade, or does that only trigger when the payload actually goes through?