Hackers hijack cPGuard updates to deploy backdoor and steal data

Attackers used compromised credentials to access OpsShield’s update infrastructure on November 2 and distribute malicious cPGuard updates. A script targeted password hashes, database configuration and SSH files. OpsShield says it stopped the malicious distribution within 12 hours. It advises administrators to update to cPGuard version 5.88.25 or later and rotate credentials that may have been exposed.