cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes

Summary: An attacker used compromised credentials to break into cPGuard's update system at 02:06 UTC on November 2 and pushed a malicious script in cPGuard versions 5.88.12 through 5.88.19, which about 2,950 customer servers ran between 02:08 and 03:20 UTC. The script installed a backdoor, read /etc/shadow, /etc/passwd, root's SSH private keys, the MySQL root password in /root/.my.cnf and root's shell history, and sent the collected files back to a server the attacker controlled. OPSSHIELD traced the intrusion to its billing and licensing server, where an attacker registered a trial account under a false identity on November 1 and gained command execution at 22:58 UTC, and said the attacker also copied three of its cloud servers and took billing records for about 7,900 customer accounts.
Bottom line: The tool customers installed to protect their Linux servers was the delivery mechanism, and the password hashes it copied can be cracked offline while secrets in database configs and shell history have no hashing to slow an attacker down. OPSSHIELD says credentials the script copied may still work after the update, so roughly 2,950 servers need new passwords and keys regardless of whether the backdoor is gone.

Read the original at The Hacker News ↗