What happened

SecurityWeek and BleepingComputer report that attackers abused compromised credentials to reach the update servers of OpsShield, the maker of the cPGuard security suite for Linux web hosting servers. OpsShield says the attack started on November 2 at 02:06 UTC and that cPGuard versions 5.88.12 through 5.88.19 carried the malicious code. According to SecurityWeek, the fake updates went out for about 70 minutes and the attack was found within 12 hours.

The update ran as root on servers that checked in during that window, and the script installed a hidden root shell plus extra files in the temp folder. BleepingComputer lists Linux password hashes, root database configuration, root shell history and root SSH authorization and known-hosts files among its targets. The collected data was sent to OpsShield's own licensing server under a compromised account.

OpsShield estimates that about 2,950 servers ran the fake update, and a spokesperson gave BleepingComputer a figure of 2946. The company says about 7,900 client account records were copied, and it is reissuing cPGuard license keys because the attackers compromised them. Hosting firms and server administrators commonly run cPGuard alongside cPanel, DirectAdmin and Plesk.

Timeline

  1. The attack on OpsShield's update infrastructure begins.[2]

Who is affected

  • Servers that updated cPGuard during the compromise window.
  • A server whose cPGuard was offline during the window did not get the fake update.

What to do

  1. Update every cPGuard server to 5.88.25 or later, which OpsShield says removes the hidden shell and the leftover files.
  2. On affected servers, treat password hashes, root SSH keys, MySQL root passwords and shell history as compromised and rotate them, along with database credentials and cloud secrets.
  3. Reset your cPGuard billing portal password even if your server did not receive the update.

Sources

Changelog

  1. First published.