OpsShield says attackers compromised the cPGuard web security suite’s update distribution infrastructure and used it to push a malicious script and a backdoor. The company said the attack began on November 2 at 02:06 UTC, affected versions 5.88.12 through 5.88.19, and may have missed some servers because update checks run at specific intervals.
cPGuard update compromise
OpsShield said it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions. It also said the attacker used legitimate credentials for the initial access, though it could not say how those credentials were obtained. The company noted that the malicious script was delivered through the cPGuard update channel.
Data theft through the update channel
The script targeted data on Linux systems. The items listed were Linux password hashes, root database configuration for MariaDB/MySQL, root shell history, and root SSH authorization and known-hosts files. OpsShield said the stolen data was uploaded to its licensing server through a compromised account, which the attackers then used to retrieve it.
The investigation has not established what data was taken from each server. The company said its evidence shows the threat actor retrieved 32 files from each customer. BleepingComputer reported that OpsShield later said nearly three thousand servers were affected, and a company representative said 2946 servers were affected and that the information mentioned was copied, along with the billing system database.
Response and follow-up steps
System administrators are advised to update every cPGuard server to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys. OpsShield said updating to the latest cPGuard version removes the backdoor and staged files, but stolen credentials still need to be invalidated as soon as possible. It also said it would release an update to remove previously installed OpsShield support-access keys as an extra precaution. The company representative said the team was working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time.
cPGuard is a Linux web-server security suite that provides malware scanning, firewalls, and attack protection. It is used by hosting firms and server administrators alongside cPanel, DirectAdmin, and Plesk, and Namecheap offers it on VPS and dedicated servers.
Licensed under CC BY-ND 4.0 International