THE CRUNCH
OpsShield, an Indian IT security firm specialising in server protection software, says attackers used compromised credentials to poison updates for cPGuard, its Linux web hosting security product, and serve malicious versions to customers. The fake updates, containing a data-stealing script, were distributed for roughly 70 minutes before being discovered within 12 hours, according to the company's incident notice.
The attackers started by targeting OpsShield's billing and licensing server: they registered an account, ordered a free cPGuard trial to study how it communicated with the licensing system, then sent crafted requests until they gained command execution. From there they collected data and uploaded a fake cPGuard update using a stolen access key.
Versions 5.88.12 through 5.88.19 carried the malicious code, which ran as root on any server that polled OpsShield's update infrastructure during the window. The script collected data and uploaded it to the licensing server under a compromised account, deployed a hidden root shell and left files in the temp folder of customer servers. OpsShield estimates 2,950 servers executed the fake updates and that the attackers copied around 7,900 client account records with names, addresses, emails and hashed passwords, plus three of the company's cloud servers. It says the hackers retrieved 32 collected files, each from a different customer server.
OpsShield advises that password hashes, root SSH keys and MySQL root passwords, as well as shell history on infected servers, should be treated as compromised and rotated. Servers that were not online during the window did not receive the fake update, though the company still recommends resetting billing portal passwords. It has evicted the attackers, reset secrets and SSH keys, is reissuing cPGuard licence keys and rebuilding its billing, licensing and internal management servers, and released cPGuard 5.88.25 and later to remove the hidden root shell and leftover files, alongside indicators of compromise.