cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
Overview
On November 2, an attacker compromised the update system of cPGuard, a security tool for Linux servers, and deployed a malicious script to its users. This script created a backdoor on the affected servers, allowing the attacker to collect sensitive information, including password hashes. The company behind cPGuard, OPSSHIELD, confirmed that some of this stolen data has already been retrieved by the attacker. The breach specifically affects users running cPGuard version 5.88.25 and later. This incident raises concerns about the security of update channels and the potential for attackers to exploit trusted software to infiltrate systems.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: cPGuard versions 5.88.25 and later
- Action Required: Users should update to the latest version of cPGuard and monitor their servers for any unauthorized access or unusual activity.
- Timeline: Newly disclosed
Original Article Summary
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions
Impact
cPGuard versions 5.88.25 and later
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Users should update to the latest version of cPGuard and monitor their servers for any unauthorized access or unusual activity.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Linux, Exploit, Update.