Hackers hijack cPGuard autoupdate to deploy backdoor
Original title: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Attackers compromised OpsShield's CDN to distribute a backdoor and data-stealing script through cPGuard updates, affecting nearly 3,000 servers.
Attackers compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. OpsShield detected the compromise on November 2 at 02:06 UTC and stopped the malicious distribution within 12 hours. The attacker used compromised credentials to gain access to the CDN and pushed malicious versions affecting cPGuard 5.88.12 through 5.88.19. Stolen data included Linux password hashes, database configurations, shell history, SSH authorization and known-hosts files.
Unconfirmed: How the initial credentials were obtained is unclear.
- Affected versions: 5.88.12 through 5.88.19.
- Nearly 3,000 servers impacted.
- Malicious script uploaded stolen data to licensing server.
- Update to version 5.88.25 or later removes the backdoor.
- Attacker leveraged legitimate credentials.
Impact: Backdoor deployed and sensitive data stolen from nearly 3,000 servers
- 1.Update cPGuard to version 5.88.25 or later.
- 2.Reset passwords and rotate database credentials, cloud secrets, and SSH keys.
- Vendors
- OpsShield
- Products
- cPGuard
- Malware
- backdoor script
- Organizations
- Namecheap
From the original article
2 min read at bleepingcomputer.com
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.