cPGuard update channel hijacked to backdoor Linux servers
Attackers used compromised credentials to push malicious cPGuard updates to about 2,950 Linux servers on November 2. OpsShield says the fake updates ran as root for roughly 70 minutes and that attackers copied password hashes, SSH keys, billing account records, and three cloud servers.
IllustrationThe story so far
On November 3, OPSSHIELD said an attacker had broken into the cPGuard update system on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it. The company said the attacker had since taken some of that data.
On November 4, OpsShield said attackers used compromised credentials to upload malicious cPGuard updates versions 5.88.12 to 5.88.19 to its update infrastructure on November 2. The fake updates ran as root on about 2,950 customer servers for roughly 70 minutes, collecting password hashes, SSH keys, database credentials and shell history. The company said attackers also copied about 7,900 billing account records and three cloud servers.
Latest updates
2 updates · newest first- 4 NovNew development
OpsShield cPGuard update channel poisoned to hit 2,950 servers
OpsShield said attackers used compromised credentials to upload malicious cPGuard updates, versions 5.88.12 to 5.88.19, to its update infrastructure on November 2. The fake updates ran as root on about 2,950 customer servers for roughly 70 minutes, collecting password hashes, SSH keys, database credentials and shell history. The company said attackers also copied about 7,900 billing account records and three cloud servers.
SecurityWeek ↗
Help Net Security ↗
CySecurity News ↗
- 3 NovNew development
cPGuard update channel hijacked to backdoor Linux servers and collect password hashes
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data.
The Hacker News ↗