Malicious cPGuard Updates Served in OpsShield Supply Chain Attack

What it is

OpsShield, an Indian vendor of server protection software, had its cPGuard update channel abused to serve malicious versions 5.88.12 to 5.88.19 to Linux web hosting servers. The page does not give an absolute date. It says only that the attack happened on a Monday. It was found within 12 hours, and the fake updates were served for about 70 minutes.

How it works

The attackers registered a customer account and ordered a free cPGuard trial to study how the product talks to the licensing system. They then sent crafted requests to the billing and licensing portal and got command execution on that server. After collecting data, they used a stolen access key to upload a fake update to the update CDN. OpsShield's incident notice also says compromised credentials gave access to the CDN. The page does not reconcile this with the stolen access key.

The update ran as root on every server that polled during the window. Its script collected data and uploaded it to the licensing server under a compromised account. It also left a hidden root shell and files in the temp folder. The attackers copied three of OpsShield's cloud servers as well.

Preconditions / Affected

• A server was exposed only if cPGuard was online and polling for updates during the window. OpsShield says servers that were offline then did not receive the fake update.
• OpsShield estimates 2,950 servers ran the fake update. The attackers pulled 32 collected files from the script's uploads, each from a different customer server.
• About 7,900 customer account records were copied. They hold names, company, addresses, emails and hashed passwords.

What to do

• Update to cPGuard 5.88.25 or later. It removes the hidden root shell and the extra files left by the script.
• On servers that ran the fake update, treat these as compromised and rotate them: all password hashes, root SSH keys, MySQL root passwords and shell history contents.
• Check servers against the IoCs OpsShield published. The page does not reproduce them.
• Reset your billing portal password even if cPGuard was offline during the window.
• OpsShield is reissuing all cPGuard license key pairs, because the attackers compromised them. It has also reset all billing portal sessions and rotated the associated API keys.

Caveats

The page gives no command for finding or removing the root shell by hand, and no file names or hashes. Those details are in OpsShield's notice and IoC list, which the article does not reproduce. OpsShield's account of the attack is its own, from an updated report.