cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions
On November 2, an attacker infiltrated the update system of the cPGuard security tool and distributed a malicious script to customers' Linux servers. This script installed a backdoor and extracted password hashes and other sensitive files from the infected servers. cPGuard 5.88.25 and later versions address these vulnerabilities by removing the backdoor and the files left behind.
If a server has run the script, new passwords and keys must be set. The attacker, whose identity remains unknown, gained access using compromised credentials. The malicious script circulated between versions 5.88.12 and 5.88.19 and was identified within 12 hours of its distribution. OPSSHIELD, the maker of cPGuard, has since secured their infrastructure credentials and halted the script's propagation.
It remains unclear how many servers were affected. Servers that check for updates periodically may not have executed the script. To verify if a server ran the affected update, admins can search for version entries from 5.88.12 through 5.88.19 within the update log. If such an entry is found, the server installed an affected update, though this does not confirm the script's execution or data exfiltration.
The stolen data includes /etc/shadow and /etc/passwd files, root's MariaDB or MySQL configuration, shell history, and SSH authorization and known-hosts files. The script may have taken only a fraction of data from each server, and OPSSHIELD is still investigating the extent of the breach. A support-access key used by OPSSHIELD to grant staff access to servers was potentially compromised, and the company has removed it from cPGuard servers.
OPSSHIELD advises immediate updates for all cPGuard servers and recommends further actions for servers that may have run the script.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
