I'm getting notifications for several UTMs across several customers, with this alert: "Failed SSH login attempt from xxx.xxx.xxx.xxx at 2017-10-22 22:28:38 with username anyname". For one customer, the alert indicates the IP address of a hyper-v host server, but the rest of the alerts are all from their DC (although for those customers, the DC is also their only server).
I thought at first it was bug, but the UTMs are at different version levels. Is there some SSH exploit that I'm not aware of?
This thread was automatically locked due to age.
Quote