Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Story 4, from BleepingComputer
Attackers compromised cPGuard's update system to distribute a backdoor and steal sensitive data from affected servers. OpsShield has released a fix and advises users to update and reset credentials.
Key points
- Attackers used compromised credentials to hijack cPGuard's update infrastructure.
- Malicious scripts were distributed via autoupdate affecting versions 5.88.12 through 5.88.19.
- Stolen data included password hashes, database configs, and SSH keys uploaded to a compromised licensing server.
- OpsShield has released version 5.88.25 to remove the backdoor and advises updating and credential rotation.
- Approximately 3,000 servers were impacted, with 2,946 confirmed affected.
- The incident highlights risks in supply-chain attacks and the importance of securing update mechanisms.
Why it matters
This incident underscores the risks of supply-chain attacks and the critical need to secure update systems. cPGuard is widely used in server environments, making this a significant security concern for many organizations.
Counterpoint
The exact method attackers used to obtain credentials remains unclear, limiting full understanding of the attack vector.
Sources
- Hackers hijack cPGuard autoupdate to deploy backdoor, steal data (BleepingComputer)
This summary was written by a language model and may contain errors. Read the original for the full story.