OpsShield Supply Chain Attack Serves Malicious cPGuard Updates to ~2,950 Servers, Exposes 7,900 Customer Records
OpsShield, an Indian IT security firm behind the cPGuard server protection product for Linux web hosting, suffered a supply chain attack in which attackers compromised its billing/licensing infrastructure and pushed malicious updates through the cPGuard CDN. The malicious code was embedded in cPGuard versions 5.88.12–5.88.19 and distributed for roughly 70 minutes before detection within 12 hours. OpsShield estimates about 2,950 servers executed the fake update, and attackers exfiltrated roughly 7,900 client account records (names, company, addresses, emails, hashed passwords) along with 32 files pulled from compromised customer servers. The attackers also deployed a hidden root shell and additional files on affected customer servers and cloned three of OpsShield's cloud servers.
Detalhes técnicos
The attackers first used a free cPGuard trial to study the licensing/billing portal's communication protocol, then sent crafted requests to gain command execution on the billing and licensing server. Using a stolen access key, they uploaded a malicious update script that ran as root on any server polling OpsShield's update infrastructure during the compromise window. The script collected data and exfiltrated it back to OpsShield's licensing server via a compromised account, while also installing a hidden root shell and dropping files into the temp folder on infected customer servers.
Remediação
OpsShield states that all password hashes, root SSH keys, MySQL root passwords, and shell history on infected servers should be considered compromised and rotated. Customers whose servers were not online during the attack window should still reset their billing portal password. OpsShield evicted attackers from affected systems, rotated secrets, removed attacker SSH keys and cloned cloud assets, replaced SSH keys/passwords, reissued all cPGuard license key pairs, reset billing portal sessions and API keys, and is rebuilding its billing, licensing, and internal management servers. A clean update (version 5.88.25 and later) was released to remove the hidden root shell and dropped files, and IoCs were published.
Linha do tempo
-
OpsShield Supply Chain Attack Serves Malicious cPGuard Updates to ~2,950 Servers, Exposes 7,900 Customer Records
ler a análise desta fonte ocultar
OpsShield, an Indian IT security firm behind the cPGuard server protection product for Linux web hosting, suffered a supply chain attack in which attackers compromised its billing/licensing infrastructure and pushed malicious updates through the cPGuard CDN. The malicious code was embedded in cPGuard versions 5.88.12–5.88.19 and distributed for roughly 70 minutes before detection within 12 hours. OpsShield estimates about 2,950 servers executed the fake update, and attackers exfiltrated roughly 7,900 client account records (names, company, addresses, emails, hashed passwords) along with 32 files pulled from compromised customer servers. The attackers also deployed a hidden root shell and additional files on affected customer servers and cloned three of OpsShield's cloud servers.
Technical Details
The attackers first used a free cPGuard trial to study the licensing/billing portal's communication protocol, then sent crafted requests to gain command execution on the billing and licensing server. Using a stolen access key, they uploaded a malicious update script that ran as root on any server polling OpsShield's update infrastructure during the compromise window. The script collected data and exfiltrated it back to OpsShield's licensing server via a compromised account, while also installing a hidden root shell and dropping files into the temp folder on infected customer servers.
Remediation
OpsShield states that all password hashes, root SSH keys, MySQL root passwords, and shell history on infected servers should be considered compromised and rotated. Customers whose servers were not online during the attack window should still reset their billing portal password. OpsShield evicted attackers from affected systems, rotated secrets, removed attacker SSH keys and cloned cloud assets, replaced SSH keys/passwords, reissued all cPGuard license key pairs, reset billing portal sessions and API keys, and is rebuilding its billing, licensing, and internal management servers. A clean update (version 5.88.25 and later) was released to remove the hidden root shell and dropped files, and IoCs were published.