OPSSHIELD
CompanySecurity timeline
- Named in breach reports by The Hacker NewscPGuard update channel hijacked to backdoor Linux servers and steal password hashes
- Named in breach reports by Cyber Security NewsAttackers hijacked cPGuard's update channel to deliver a backdoor to Linux hosting servers
Recent news
cPGuard update channel hijacked to backdoor Linux servers and steal password hashes
An attacker compromised the update channel of the cPGuard security tool on 2 November and distributed a malicious script to customers' Linux servers. The script installed a backdoor and harvested password hashes and other sensitive files, and the maker OPSSHIELD says some of that data has already been exfiltrated.
Attackers hijacked cPGuard's update channel to deliver a backdoor to Linux hosting servers
An unidentified attacker used stolen credentials to access OPSSHIELD's update distribution infrastructure and pushed a malicious script through cPGuard versions 5.88.12 to 5.88.19. The script installed a backdoor and collected Linux account files, database configuration, shell history and root SSH material, which were sent to a compromised OPSSHIELD licensing server. OPSSHIELD says 32 collected files had been retrieved so far, and the fix is version 5.88.25 or later.