OPSSHIELD, developer of the cPGuard Linux server security tool, said an attacker used compromised credentials to access its update distribution infrastructure at 02:06 UTC on November 2 and push a malicious script through versions 5.88.12 through 5.88.19.
The company detected the intrusion within 12 hours, secured the compromised account, cleared infrastructure credentials and stopped further distribution, according to its security advisory.
The script collected files including /etc/shadow and /etc/passwd, root database configuration, root shell history, and root SSH authorization and known-hosts files. The data was uploaded to OPSSHIELD’s licensing server under a compromised account for later retrieval.
In a November 3 update, OPSSHIELD estimated that the attacker retrieved 32 collected files from data uploaded to its server, each corresponding to a customer server. The company described this as a preliminary count of confirmed data retrieval, not the total number of potentially affected servers, and said it was still verifying the scope.
BleepingComputer reported on November 3 that an OPSSHIELD spokesperson said 2,946 servers were affected and the company’s billing-system database was also copied. The spokesperson said the company was blocking access, rebuilding affected systems and preparing a public announcement. The statement adds a broader server-impact estimate, while the extent of data taken from individual systems remains under investigation.
OPSSHIELD said cPGuard 5.88.25 includes a corrective update that removes the known backdoor and files staged by the script. Its release notes list version 5.88.26 as a further security update that revokes support access on servers where it had been enabled.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The company has not disclosed how the attacker obtained the credentials used to access its distribution infrastructure. It also said some servers that installed affected versions may not have executed the script because update checks run at intervals.
