OpsShield Supply-Chain Attack Sent Malicious cPGuard Updates to an Estimated 2,950 Servers
Summary
OpsShield says attackers used compromised credentials to distribute malicious cPGuard updates. The company estimates 2,950 servers ran them and about 7,900 client account records were copied; it has released cleanup updates and rotated credentials.
Key points
- According to OpsShield, attackers used compromised credentials to access its update distribution infrastructure and upload a malicious cPGuard update.
- Versions 5.88.12–5.88.19 contained the malicious code; the updates were distributed for about 70 minutes before the incident was discovered.
- The update ran as root on servers that polled OpsShield during the compromise window and installed a hidden root shell and additional files.
- OpsShield estimates that 2,950 servers executed the fake updates and that attackers copied about 7,900 client account records, including hashed passwords.
- The company says the script collected data and that attackers retrieved 32 uploaded files, each from a different customer server.
- OpsShield advises affected customers to rotate passwords and other potentially compromised credentials; it released cPGuard 5.88.25 and later to remove the planted files.
Article Details
- Victim Organization
- OpsShield
- Incident Type
- Supply-chain attack involving compromised credentials and malicious cPGuard updates distributed through OpsShield's update infrastructure.
- Data Types Exposed
- Names
- Company names
- Addresses
- Email addresses
- Hashed passwords
- Root SSH keys
- MySQL root passwords
- Shell history
- Affected Records
- OpsShield estimates that approximately 7,900 client account records were copied. It also reports retrieving 32 files collected by the malicious script, each from a different customer server.
- Affected Data Size
- Approximately 7,900 client account records; 32 collected files were retrieved. OpsShield estimates that 2,950 servers executed the malicious updates.
- Operational Impact
- Malicious cPGuard versions 5.88.12–5.88.19 were distributed for roughly 70 minutes. The update executed as root on servers that polled the update infrastructure during the compromise window, and deployed a hidden root shell and additional files. Attackers also copied three OpsShield cloud servers. OpsShield removed the attackers' access, rotated credentials and keys, and began rebuilding billing, licensing, and internal management servers.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed