OpsShield, an Indian IT security firm, has revealed a significant security breach affecting its cPGuard software updates. The attack involved unauthorized access to OpsShield's update distribution system, allowing malicious updates to be sent through the cPGuard update channel. The affected versions ranged from 5.88.12 to 5.88.19 and were active for about 70 minutes before detection.
Attackers gained entry by exploiting compromised credentials to infiltrate OpsShield’s billing and licensing server. They then deployed a fake cPGuard update using a stolen access key, which executed with root privileges on the affected servers. During this time, the attackers also cloned three of OpsShield’s cloud servers. The malicious code collected data from infected systems and sent it to the licensing server using a compromised account. OpsShield reported that 32 files were extracted from customer servers, which included deploying a hidden root shell and additional files in the affected systems' temporary directories.
Approximately 2,950 servers executed these malicious updates, leading to the exfiltration of around 7,900 client account records. The stolen data included personal information such as names, addresses, emails, hashed passwords, and sensitive credentials like root SSH keys and MySQL passwords. In response, OpsShield advised all users to reset their billing portal passwords and took swift action to mitigate the breach. This included removing unauthorized access, revoking stolen keys, and replacing all SSH keys and passwords across its systems.
OpsShield has rebuilt its billing, licensing, and internal management servers, releasing new versions of cPGuard starting from 5.88.25 to remove any remaining malicious components. The company also shared indicators of compromise to help with detection and response efforts. Highlighting the sophistication of modern supply chain attacks, OpsShield is committed to strengthening its update processes to prevent future incidents. Users of cPGuard are encouraged to update to the latest version and review their security settings to ensure protection against similar threats.
