An unidentified hacker compromised cPGuard server security and management suite for Linux web hosting environments to infect thousands of customers’ servers.
cPGuard is developed by India-based OpsShield, which specializes in security plugins, malware scanners, and server management tools for Linux web hosting platforms.
The company on Tuesday disclosed that an unidentified attacker gained unauthorized access to OPSSHIELD’s update distribution infrastructure to push a malicious script through the cPGuard update channel. The attack impacted cPGuard 5.88.12 through 5.88.19.
The malicious update was active for about 70 minutes, during which about 2,950 customer servers ran it, and the attacker gained access to their password hashes, root SSH keys, MySQL root passwords, and shell histories.
The threat actor also copied records for about 7,900 OPSSHIELD billing portal accounts, the company’s centralized customer account and financial management system, including names, company details, postal and email addresses, as well as hashed passwords.
“We have confirmed that the attacker retrieved some collected data from that server and are investigating the extent of that retrieval. Upon discovering the breach, OPSSHIELD secured that account, cleared its infrastructure credentials, and stopped further distribution of the script,” the company said.
Attack tactics
The attack stemmed from a customer account that the hacker registered on Nov. 1 using the company’s billing application at manage.opsshield.com. The attacker then used the account to order a free cPGuard trial.
The attacker then sent crafted requests to the billing portal’s callback pages and then ran commands on the billing and licensing server. Using a stolen key, the hacker uploaded a fake cPGuard update to the company’s update storage.
When the update was executed, it ran as root and copied sensitive files from the customer servers.
The attacker also made copies of three of the company’s cloud servers, OPSSHIELD said.
“Our logs do not record the exact request that gave them access, so we are reviewing that code, patched two possible entry points that we found, and [verifying] the related vendor components line by line. We have ruled out SSH, the control panel, FTP, API tokens, etc.,” the company said.
OPSSHIELD has revoked the stolen update and SSH keys, as well as removed the attackers’ tools. The company removed cloned servers and snapshots from its cloud account.
The company has further urged cPGuard customers to reset their manage.opsshield.com account passwords, change root passwords and every local user password on their servers, and to generate new root SSH keys.
