Malicious cPGuard Updates Distributed in OpsShield Supply Chain Attack
Original title: Malicious cPGuard Updates Served in OpsShield Supply Chain Attack
Fake updates ran for 70 minutes, compromising 2,950 servers and 7,900 accounts.
OpsShield discovered malicious cPGuard updates served via compromised CDN credentials. The fake updates collected data and installed root shells on customer servers. Attackers gained access to 7,900 account records.
- Fake updates distributed for roughly 70 minutes
- 2,950 servers affected
- 32 files retrieved from infected servers
- cPGuard versions 5.88.12–5.88.19 impacted
Impact: data theft including passwords and SSH keys from 2,950 servers
- 1.Reset billing portal password
- 2.Replace all SSH keys and passwords
From the original article
2 min read at securityweek.com
Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions. The post Malicious cPGuard Updates Served in OpsShield Supply Chain Attack appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.