Attackers push malicious updates to OpsShield cPGuard customers
Original title: Attackers turned OpsShield’s trusted update channel into a supply-chain attack
Attackers compromised the vendor update channel for 70 minutes and distributed fake updates to ~2,950 customer servers, exposing password hashes and SSH keys; OpsShield is rebuilding affected systems and urging…
Between November 1-2, threat actors used stolen credentials to access OpsShield's update infrastructure and push malicious root-level updates. This affected ~2,950 cPGuard servers by exposing password hashes, root SSH keys, MySQL passwords and shell histories. They also accessed ~7,900 billing portal accounts. The company has shut out the attackers, rebuilt servers, issued clean updates and is re-issuing licenses.
Unconfirmed: Exact request that granted access still under review by OpsShield
- 70-minute window of malicious update distribution
- ~2,950 servers exposed
- ~7,900 billing accounts accessed
- v5.88.26 and follow-up updates released
- new license keys issued
Impact: customer password hashes, SSH keys and MySQL passwords exposed
- 1.update cPGuard to v5.88.26
- 2.generate new SSH keys
- 3.change all passwords
From the original article
5 min read at csoonline.com
The kinks in the software supply chain are once again being exposed, with attackers now targeting OpsShield’s update process. This week, threat actors used compromised credentials to push malicious updates out to cPGuard customers. They then accessed data stored on the vendor’s servers and in its billing portal accounts, and made copies of at least three of OpsShield’s cloud servers.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.