cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes

The attacker used compromised credentials to infiltrate cPGuard's update system at 02:06 UTC on November 2, sending malicious scripts to customers' Linux servers. These scripts installed a backdoor and collected sensitive information including password hashes and configuration files. The attacker has since accessed some of this stolen data, according to cPGuard maker OPSSHIELD.

Attack Details

The malicious updates were distributed in cPGuard versions 5.88.12 through 5.88.19. OPSSHIELD detected the breach within 12 hours of these versions being released and has since secured its infrastructure and prevented further script distribution. The company is still investigating how the attacker obtained the credentials.

The script targeted sensitive files including /etc/shadow and /etc/passwd, root's MariaDB or MySQL configuration, shell history, and SSH authorization files. It uploaded collected data to an OPSSHIELD licensing server using a compromised account, from which the attacker later retrieved 32 files, though the total number of affected servers remains unknown.

Detection Methods

Administrators can check if their servers installed an affected version by searching the update log with the command: grep 'Successfully updated' /opt/cpguard/logs/install_log. Any entry showing versions 5.88.12 through 5.88.19 indicates the server received the malicious update. Even if the server now runs version 5.88.25 or later, it should be treated as potentially compromised.

Servers without matching log entries may still have run the script if their update logs are incomplete or missing. Administrators with uncertainty are advised to contact OPSSHIELD Support for assistance.

Recovery Steps

OPSSHIELD requires administrators to immediately update all cPGuard servers to version 5.88.25 or later by running 'cpgcli update --start' and verifying the version with 'cpgcli --version'. For any server that may have run the script, administrators must reset passwords for all local Linux accounts from a trusted recovery environment.

Additional necessary actions include changing passwords used on other systems, rotating database passwords and access keys, replacing SSH private keys, and removing old public keys from trusted systems. While a full operating system rebuild isn't currently recommended, it may become necessary for servers showing other signs of compromise.

Evidence of Compromise

OPSSHIELD has identified specific files left behind by the malicious script, including the backdoor shell at /var/tmp/.cpg91511_sh and a collection directory at /var/tmp/.cpg91511 containing an archive file named loot.tgz. The malicious script itself was named cpguard-v58812-i91511.sh. While the update removes these files, their absence doesn't confirm whether the script ran.