You know that ?si= at the end of the YouTube URL that is copied when you share a video from within the YouTube app?
That's an individual tracking ID specific to you. So if you've ever shared a YouTube video on lemmy, reddit, Facebook, tiktok, or anywhere else without removing that code one time, anyone at Google with access to the ID system can now link you to that account with your real name, IP address and time accessed, device name, etc.
In turn it ~~compromises ssh authentication~~ allows remote code execution via system(); if the connecting SSH certificate contains the backdoor key. No user account required. Nothing logged anywhere you'd expect. Full root code execution.
There is also a killswitch hard-coded into it, so it doesn't affect machines of whatever state actor developed it.
It's pretty clear this is a state actor, targeting a dependency of one of the most widely used system control software on Linux systems. There are likely tens or hundreds of other actors doing the exact same thing. This one was detected purely by chance, as it wasn't even in the code for ssh.
If people ever wonder how cyber warfare could potentially cause a massive blackout and communications system interruption - this is how.