OPSShield says attackers copied records for about 7,900 customer accounts from its billing and licensing server during the cPGuard update-channel compromise.
The records included names, company names, postal addresses, email addresses and bcrypt-hashed passwords, according to the vendor’s November 3 incident disclosure. The expanded scope was also detailed in SecurityWeek’s report.
The account records were taken after the attacker registered a customer account under a false identity, ordered a free cPGuard trial and later gained command execution on the billing and licensing server through crafted requests to callback pages. OPSShield said the attacker then obtained the key used to publish updates and uploaded malicious cPGuard versions 5.88.12 through 5.88.19 between 02:04 and 02:09 UTC on November 2.
The fake updates were installed on about 2,950 customer servers between 02:08 and 03:20 UTC and ran with root privileges. The script collected local password hashes, root SSH files, MySQL root credentials where present, root shell history and cloud-storage keys from a small number of servers. It also left a hidden root shell and a scheduled task on affected systems.
OPSShield said clean release 5.88.26 removes the hidden root shell, while a follow-up update removes the scheduled task. The company revoked the stolen update key, reset billing-portal sessions, rotated its own credentials and API keys, and began reissuing cPGuard license keys. It is rebuilding billing, licensing and internal management servers from clean images.
The vendor has not identified the exact request that enabled the attacker to run commands on the billing server. OPSShield said it patched two possible entry points found during its review and is continuing to investigate the initial access and the extent of data retrieved from individual customer servers.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
