Attackers poison OpsShield cPGuard updates, breach 2,950 servers

SecurityWeek reports that OpsShield, an Indian IT security company, was compromised through its update distribution infrastructure, with attackers serving malicious cPGuard updates to customers. Using hijacked credentials, the intruders gained access to OpsShield’s update CDN and distributed a malicious script via the cPGuard update channel. The tainted versions ranged from 5.88.12 to 5.88.19 and were active for roughly 70 minutes before detection.

OpsShield’s incident timeline indicates the attackers first targeted the billing and licensing server, created a fraudulent customer account for a free cPGuard trial to study licensing communications, and then issued crafted requests to the portal. Once the hackers achieved command execution on the billing server, they exfiltrated data and uploaded a fake cPGuard update using a stolen access key.

The malicious update ran with root privileges on servers that polled OpsShield’s update infrastructure, while the attackers copied three cloud servers. The script was designed to collect data from infected servers and upload it to the licensing server under a compromised account, and it deployed a hidden root shell plus files in the temp directory.

OpsShield estimates 2,950 servers executed the fake updates and that about 7,900 client account records—containing names, company, addresses, emails and hashed passwords—were copied. All password hashes, root SSH keys, MySQL root passwords and shell history should be considered compromised and rotated.

OpsShield has since evicted the attackers, reset secrets, replaced SSH keys and passwords, reissued license keys, rotated API keys, and published cPGuard updates from version 5.88.25 onwards that remove the hidden root shell and related files, along with IoCs.