Confirmed an attempt to install Python3 on GT10 after exploiting the Alpine SSH vulnerability

GreyNoise reported that attackers tracked as GT10 exploited an Alpine Linux SSH authentication-bypass vulnerability to breach one of its honeypot servers in Southeast Asia, first disclosed on the 9th. The group attempted to install Python3 on a server that lacked it and used the remote-access tool TAC Agent during the intrusion. GreyNoise also accessed the server GT10 used, gathering clues about potential victims and the attacker's toolset. The finding matters because it confirms active in-the-wild exploitation of the Alpine SSH flaw and links it to a known threat group's toolkit. What to watch next is whether GT10 widens its targeting beyond the honeypot and whether other exposed Alpine-based systems show the same Python3 and TAC Agent fingerprints.