OpsShield

Summary

OpsShield suffered a supply chain attack in which compromised credentials accessed its update infrastructure and served malicious cPGuard updates to customers. Versions 5.88.12 through 5.88.19 contained code that collected data, uploaded it to the licensing server, deployed a hidden root shell, and left files in temporary folders. About 2,950 servers executed the fake updates while attackers copied roughly 7,900 client account records including names, addresses, emails, and hashed passwords. The company evicted intruders, reset secrets, removed SSH keys, rebuilt servers, and released patched updates removing the malicious components.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Indian IT security company OpsShield experienced a cyberattack on Monday that resulted in malicious versions of cPGuard being served to its customers. OpsShield specializes in server protection and web security software, and cPGuard is its most notable product, designed for Linux web hosting servers. According to the company’s incident notice, the attackers used compromised credentials to access its update distribution infrastructure, or CDN, and distribute a malicious script via cPGuard’s update channel. The supply chain attack affected cPGuard versions 5.88.12 through 5.88.19. The attackers first targeted the company’s billing and licensing server by registering a customer account and ordering a free cPGuard trial to study its communication with the licensing system. They then began sending crafted requests to the portal. After obtaining command execution on the billing and licensing server, the hackers started collecting data and subsequently uploaded a fake cPGuard update using a stolen access key.

The fake update was executed as root on the servers that polled OpsShield’s update infrastructure during the compromise window. At the same time, the attackers copied three of the company’s cloud servers. The malicious script in the updates was designed to collect data and upload it to OpsShield’s licensing server under a compromised account. According to the company, the hackers retrieved 32 collected files from the data uploaded by the script, with each file originating from a different customer server. Additionally, the script deployed a hidden root shell and certain files in the temp folder of customers’ servers. OpsShield estimates that 2,950 servers executed the fake cPGuard updates. The attackers also copied approximately 7,900 client account records containing names, company details, addresses, emails, and hashed passwords. The supply chain attack was discovered within 12 hours, and the fake updates were distributed for roughly 70 minutes.

OpsShield stated that all password hashes, root SSH keys, MySQL root passwords, and shell history on the infected customer servers should be considered compromised. The company said it evicted the attackers from all servers they may have touched and reset secrets on its account. It removed the attacker’s SSH key and cloned assets from its cloud account, and replaced all SSH keys and passwords across its servers. Additionally, OpsShield started reissuing all cPGuard license private and public keys because the attackers compromised them. The company reset all billing portal login sessions and rotated associated API keys. It is rebuilding its billing, licensing, and internal management servers. OpsShield also released cPGuard updates, version 5.88.25 and later, that remove the hidden root shell and the additional files left behind by the script, and published indicators of compromise.

OpsShield stated that if cPGuard was not online during the compromise window, the server did not receive the fake update, and that customers should still reset their billing portal password. The company noted that attacks like this one are getting faster and cheaper to run, and that its answer is to harden its own update and signing process first and then put what it learned back into cPGuard for customers.

Sources

Sources available to members: 1 source.