Attackers abused OpsShield's cPGuard update channel to push a malicious root update
- Severity
- Critical
- Sources
- 1
What happened
OpsShield's cPGuard update infrastructure was compromised between 1 and 2 November, with a malicious update pushed for about 70 minutes and run as root on roughly 2,950 customer servers. The attacker entered via a billing portal trial account and crafted requests, then used stolen access keys and copied three cloud servers; about 7,900 billing accounts were exposed. Clean build v5.88.26 removes the hidden root shell, with a follow-up removing the scheduled task. Defenders should update cPGuard and check for /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511sh, rotate root, local, MySQL and database credentials and SSH keys, enable 2FA on billing accounts, and treat unpatched servers as compromised. Rebuild any host where the attacker logged in manually from a pre-1 November backup.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update cPGuard to the latest version and check that /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511sh are gone, deleting them if they remain.
- Change root and all local user passwords, MySQL root and database passwords, and any passwords, API keys or tokens found in root shell histories.
- Generate new root SSH keys and remove the old ones from every server that trusted them, treating servers as compromised until this is done.
- Reset OpsShield billing portal passwords and turn on two-factor authentication.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies
Products