cPGuard update channel breach infects about 2,950 customer servers
An attacker stole credentials from cPGuard developer OPSSHIELD, breached its update distribution infrastructure and distributed malicious updates. About 2,950 customer Linux servers executed malicious scripts, resulting in backdoor installation and the collection of password hashes, SSH keys, and database and cloud credentials. Customer contact information and hashed passwords were also stolen from OPSSHIELD’s billing and licensing server.
Key facts
- Affected organisation
- OPSSHIELD
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Malicious scripts executed on about 2,950 customer servers; customer contact information, password hashes and sensitive server information stolen
- Cause / method
- An attacker used stolen credentials to breach cPGuard’s update infrastructure and distribute malicious updates
- Location
- Other countries
If your data was exposed
Exposed dataPassword
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
Timeline
- A breach of cPGuard’s update system resulted in the distribution of backdoors and information-gathering scripts to customer servers, with files believed to have been exfiltrated from at least 32 customer servers.
- It emerged that malicious updates had been distributed to about 2,950 customer servers and that customer contact information and hashed passwords had been stolen from OPSSHIELD’s billing and licensing server.
- It emerged that malicious scripts had run with root privileges on customer Linux servers, collected SSH keys and database and cloud credentials, and installed mechanisms for persistent access.
7 related reports
- cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
- Poisoned cPGuard update hits thousands of web hosting servers
- Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
- cPGuard update-channel compromise demands secret rotation
- Hackers backdoor Linux servers using trojanized CWP web server
- cPGuard update hijack: check servers, then rotate secrets
- 9th November – Threat Intelligence Report
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.