Threat Pulse 62High
cPGuard auto-update hijacked (OpsShield billing server breached) to push backdoor to hosting servers
Severity 6ActiveconfirmedCloud and SaaS

cPGuard auto-update hijacked (OpsShield billing server breached) to push backdoor to hosting servers

· 11 days ago · securityweek.com
Sourcessecurityweek.comHelp Net Security
On X
@BleepinComputerverifiedNov 3, 22:19 UTC

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

Open on X
@TheHackersNewsverifiedNov 4, 16:17 UTC

‼️ UPDATE - The cPGuard attacker used a fake customer account and free trial to breach OPSSHIELD's billing server. They stole a software update signing key and used it to push malware to nearly 3,000 #Linux servers. OPSSHIELD is now reissuing all cPGuard lic

Open on X
@SecurityWeekverifiedNov 5, 02:58 UTC

Malicious cPGuard Updates Served in OpsShield Supply Chain Attack

Open on X
Why this score

Plan rubric with caps (verified sweep, Nov 11)

Back to the board

Updated Nov 14, 03:49 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.