Attacker uses cPGuard updates to install backdoors on Linux servers
A malicious script distributed through the security tool’s compromised update channel collected password hashes and other sensitive files from affected servers. Maker OPSSHIELD confirmed that the attacker retrieved some stolen data. The company urged administrators to install cPGuard version 5.88.25 or later immediately following the compromise.
- The update-system intrusion occurred on November 2, according to The Hacker News.
Covered by 2 publishers within 5 hours of the first report.
Reporting2
Cyber Security News Hackers Hijacked Linux Hosting Server Security Tool cPGuard and Used It as a Backdoor · Guru Baran
The Hacker News cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes · info@thehackernews.com (The Hacker News)