Loading story…
Researchers working with the badkeys project found hundreds of internet-exposed RSA and DSA keys whose private values were generated with strong zero-bit bias, creating distinctive “short-sleeve” patterns that made the keys vulnerable to recovery. By applying a polynomial-based factorization method to public-key datasets, they recovered 603 unique RSA private keys and 74 DSA keys tied to one recurring pattern, along with 26 additional RSA keys matching a second unexplained pattern observed in expired certificates and some NetApp-associated devices.
The primary pattern was traced to a type-mismatch flaw in EnterpriseDT’s CompleteFTP key-generation code, where 8-bit random bytes were copied into 32-bit big-integer limbs, weakening RSA keys generated in versions 10.0.0–12.0.0 and DSA keys in versions 10.0.0–23.0.4. EnterpriseDT released CompleteFTP v26.1.0 and a standalone detection tool to identify affected keys and prompt regeneration, while badkeys added support for detecting the vulnerable short-sleeve RSA pattern in public-key scans.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
The badkeys project added detection support for the vulnerable short-sleeve RSA pattern so affected keys could be identified more easily. This was reported alongside EnterpriseDT's remediation steps.
By exploiting the structured zero-bit patterns, the researchers developed and applied a polynomial-based factorization method to recover 603 unique RSA private keys and 74 DSA keys tied to CompleteFTP. They also recovered 26 RSA keys associated with the second unexplained pattern.
The researchers traced one major short-sleeve key pattern to a type-mismatch bug in EnterpriseDT CompleteFTP's big-integer random generation code. The flaw affected RSA key generation in versions 10.0.0–12.0.0 and DSA key generation in versions 10.0.0–23.0.4.
Researchers working with the badkeys project found hundreds of RSA and DSA keys with heavily biased zero-bit patterns that made private key recovery feasible. They identified two recurring short-sleeve RSA patterns, one linked to CompleteFTP and another that remained unexplained.
EnterpriseDT responded by releasing CompleteFTP v26.1.0 along with a standalone tool to detect vulnerable keys and prompt regeneration. Malware News specifies this release occurred on May 8, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceschneier.com
Open sourcemalware.news
Open sourceblog.trailofbits.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw in **PuTTY** tracked as **`CVE-2024-31497`** allowed recovery of **NIST P-521 ECDSA private keys** because the client generated biased nonces during signature creation. Public advisories and downstream vendor notices said the issue affected PuTTY-based signing operations and could let attackers derive a private key from a sufficient number of signatures, putting SSH authentication and related trust relationships at risk where vulnerable keys were used. The vulnerability was disclosed through **oss-security** and subsequently addressed by multiple Linux vendors, including **Red Hat**, **SUSE**, and **Debian LTS**, while **Citrix** warned administrators to apply manual mitigations for affected environments. The broad guidance across advisories was to **upgrade PuTTY to a fixed release**, stop using impacted **P-521** keys for signing, and **rotate any potentially exposed private keys** and dependent authorized keys or certificates to prevent continued compromise.
Jul 12, 2026
OpenSSL disclosed **CVE-2018-0737**, a low-severity cache-timing side channel in RSA private-key generation affecting versions before `1.0.2p` and `1.1.0i`. Three non-constant-time execution paths, including `BN_gcd`, could leak sensitive state to an attacker able to run a precisely timed cache attack on the same physical system while a key is generated, potentially allowing recovery of the newly generated RSA private key. Researchers demonstrated recovery through the `BN_gcd` path at an approximately 30% success rate across more than 10,000 cluster trials. OpenSSL incorporated fixes into `1.0.2p` and `1.1.0i`, with patches also available through upstream commits `349a41da1` and `6939eab03`. Exploitation requires stringent local or adjacent-system access and observation at the moment of key generation, limiting practical exposure; keys generated and retained in hardware security modules are not affected. Red Hat issued fixes for affected RHEL 7 and later systems and JBoss Core Services products.
Aug 29, 2026
Researchers demonstrated that **remote timing attacks** against OpenSSL could recover long-term private keys from general-purpose servers, overturning the assumption that such side channels were only practical against local devices. One line of work showed that OpenSSL `0.9.7` systems using RSA without blinding—including deployments such as **Apache `mod_ssl`** and **stunnel**—leaked enough information during CRT-based decryption to extract a `1024-bit` RSA private key with roughly **1 million to 1.4 million queries** in about **two hours** under typical conditions. The leakage stemmed from timing differences tied to Montgomery extra reductions and the choice between Karatsuba and normal multiplication, and the attack was shown to work across processes, virtual machines, and routed campus networks.
Jun 29, 2026