Security Tool's Update Channel Hijacked to Backdoor Linux Servers and Steal Password Data

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. According to maker OPSSHIELD, the attacker used compromised credentials to get in at 02:06 UTC. The script went out in versions 5.88.12 through 5.88.19, installed a backdoor and collected sensitive files. The attacker has since taken some of that data. The attack was detected within 12 hours, and OPSSHIELD has cleared its infrastructure credentials and stopped the script reaching more servers. It is still investigating how the credentials were obtained.

The script collected files including /etc/shadow and /etc/passwd, root's MariaDB or MySQL configuration, root's shell history, and root's SSH authorization and known-hosts files. It may not have taken every file from every server. Password hashes can be cracked offline if passwords are weak, common or previously leaked, and secrets in database configuration or shell history have no hashing to protect them. OPSSHIELD has not said how many servers installed an affected version.

Version 5.88.25 and later remove the backdoor and the files the script left, but credentials the script copied may still work. Admins can search the update log at /opt/cpguard/logs/install_log for 'Successfully updated' entries matching the affected versions. A match does not prove the script ran, and a missing or incomplete log does not prove it did not. Any server that may have run the script should be treated as potentially compromised, with new passwords and keys issued. Unsure admins can contact OPSSHIELD Support.