cPGuard Update Infrastructure Compromised to Deploy Backdoor Malware

OpsShield, the developer behind the cPGuard web security suite, has disclosed a security breach involving its update distribution infrastructure. Threat actors compromised the content delivery network (CDN) to push a backdoor and an information-stealing script to users during a routine update cycle.

Key Highlights - The attack occurred on November 2, starting at 02:06 UTC. - Versions 5.88.12 through 5.88.19 were affected by the supply-chain compromise. - The vendor stopped the malicious distribution within 12 hours of the initial push. - Nearly 3,000 servers were impacted by the malicious script execution.

Attack Details and Data Theft According to OpsShield, the attacker leveraged compromised legitimate credentials to gain unauthorized access to the distribution network. The injected script targeted sensitive files on victim machines, uploading the harvested data back to OpsShield's licensing server through an account controlled by the threat actor. Forensic investigations revealed that attackers retrieved 32 files from each affected server, and the company's billing system database was also copied. A spokesperson confirmed that exactly 2,946 servers were impacted by the incident before the malicious distribution was halted.

Recommended Actions for Administrators System administrators running cPGuard are strongly advised to update their servers to version 5.88.25 or later immediately. While updating removes the deployed backdoor and staging files, organizations must take additional steps to secure their infrastructure. Administrators should immediately reset passwords, rotate database credentials, cloud secrets, and SSH keys that may have been exposed on potentially compromised machines to prevent further unauthorized access.