cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)

Key facts for cPGuard update hijack

Detection coverage for cPGuard update hijack

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5162 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: cPGuard Backdoor Credential Harvest, Staging and loot.tgz Archive (Splunk) — Post-Exploitation

Detects the collection phase of the cPGuard supply-chain script: staging in the hidden directory /var/tmp/.cpg91511, archiving to loot.tgz, and bulk access to /etc/shadow, /etc/passwd, root my.cnf, /root/.bash_history and /root/.ssh/authorized_keys|known_hosts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.008, T1552.003, T1005, T1074.001, T1560.001
• Data sources: linux_auditd, microsoft_defender_for_endpoint_linux, sysmon_for_linux
• Severity: high
• Confidence: high

Splunk SPL

index=linux (sourcetype=linux_audit OR sourcetype=auditd) ("/var/tmp/.cpg91511" OR "loot.tgz" OR "/etc/shadow")
| eval staging=if(match(_raw,"/var/tmp/[.]cpg91511") OR match(_raw,"loot[.]tgz"),1,0), shadow=if(match(_raw,"/etc/shadow"),1,0), history=if(match(_raw,"/root/[.]bash_history"),1,0), mycnf=if(match(_raw,"my[.]cnf"),1,0), sshfiles=if(match(_raw,"/root/[.]ssh/(authorized_keys|known_hosts)"),1,0)
| bin _time span=10m
| stats sum(staging) as staging sum(shadow) as shadow sum(history) as history sum(mycnf) as mycnf sum(sshfiles) as sshfiles by host _time
| eval sensitive_sets=(shadow>0)+(history>0)+(mycnf>0)+(sshfiles>0)
| where staging>0 OR sensitive_sets>=3

Microsoft KQL

let lookback = 7d;
union
(DeviceProcessEvents
 | where Timestamp > ago(lookback)
 | where ProcessCommandLine has_any ("/var/tmp/.cpg91511", "loot.tgz")
     or (FileName in~ ("tar", "gzip", "cp", "zip") and ProcessCommandLine has "/etc/shadow"
         and ProcessCommandLine has_any ("/root/.bash_history", "my.cnf", "authorized_keys", "known_hosts"))
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, Source = "process"),
(DeviceFileEvents
 | where Timestamp > ago(lookback)
 | where FolderPath has "/var/tmp/.cpg91511" or FileName =~ "loot.tgz"
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName = InitiatingProcessAccountName, Source = "file")
| order by Timestamp desc

Sigma

title: cPGuard Backdoor Credential Harvest, Staging and loot.tgz Archive
id: 8c4e7f20-3a91-4b5d-8e66-2f1d7a9c5b02
status: experimental
description: Detects the collection phase of the cPGuard supply chain script, staging in /var/tmp/.cpg91511, archiving to loot.tgz and bulk access to /etc/shadow with root history, my.cnf and SSH files
references:
    - https://opsshield.com/notice/cpguard-update-channel-compromise.html
    - https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html
    - https://attack.mitre.org/techniques/T1003/008/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.credential-access
    - attack.t1003.008
    - attack.t1552.003
    - attack.collection
    - attack.t1005
    - attack.t1074.001
    - attack.t1560.001
logsource:
    category: process_creation
    product: linux
detection:
    selection_loot:
        CommandLine|contains:
            - '/var/tmp/.cpg91511'
            - 'loot.tgz'
    selection_tool:
        Image|endswith:
            - '/tar'
            - '/cp'
            - '/gzip'
            - '/zip'
    selection_shadow:
        CommandLine|contains: '/etc/shadow'
    selection_other:
        CommandLine|contains:
            - '/root/.bash_history'
            - 'my.cnf'
            - 'authorized_keys'
            - 'known_hosts'
    condition: selection_loot or (selection_tool and selection_shadow and selection_other)
falsepositives:
    - Backup or migration scripts that archive /etc/shadow together with /root dotfiles and my.cnf
    - Administrators copying account files during server migration
level: high

Known false positives:

• Full-server backup or cPanel/WHM account-migration jobs that archive /etc/shadow with root config files
• Administrators copying account databases between hosts during maintenance

Tuning notes: Allow-list known backup/migration job command lines and service accounts. The loot.tgz and .cpg91511 branches are high fidelity; the multi-file branch is behavioural and can be tightened by requiring the parent to be a shell spawned from /opt/cpguard. Add auditd -w watch rules on /etc/shadow, /root/.bash_history, /root/.ssh and my.cnf so reads are logged.

• 🔒 cPGuard Trojanized Update Script and Backdoor Shell Execution (Sentinel/Defender KQL) — Exploitation · unlock with TL Creds
• 🔒 cPGuard Backdoor Credential Harvest, Staging and [indicator] Archive (Sentinel/Defender KQL) — Post-Exploitation · unlock with TL Creds
• 🔒 cPGuard Exfiltration to OPSSHIELD Licensing Server via Script or CLI Client (Sentinel/Defender KQL) — C2 / Exfiltration · unlock with TL Creds
• 🔒 cPGuard Trojanized Update Script and Backdoor Shell Execution (Sigma) — Exploitation · unlock with TL Creds
• 🔒 cPGuard Backdoor Credential Harvest, Staging and [indicator] Archive (Sigma) — Post-Exploitation · unlock with TL Creds
• 🔒 cPGuard Exfiltration to OPSSHIELD Licensing Server via Script or CLI Client (Sigma) — C2 / Exfiltration · unlock with TL Creds
• 🔒 cPGuard Trojanized Update Script and Backdoor Shell Execution (Splunk) — Exploitation · unlock with TL Creds
• 🔒 cPGuard Exfiltration to OPSSHIELD Licensing Server via Script or CLI Client (Splunk) — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise for cPGuard update hijack

As of 2026-11-03, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5162.

How cPGuard update hijack works

On 2026-11-02 at 02:06 UTC an attacker used compromised credentials to gain unauthorized access to the update delivery infrastructure (described in the vendor advisory as OPSSHIELD's CDN) for cPGuard, a commercial server security product for Linux hosting environments. Per the vendor, the compromise was detected within 12 hours.

The attacker distributed a malicious shell script named cpguard-v58812-i91511.sh through the legitimate update channel. Versions 5.88.12 through 5.88.19 (inclusive) contain the malicious code. Because cPGuard runs with root privileges on cPanel/WHM, DirectAdmin, Plesk, standalone and other supported platforms, the script executed with full privileges on updating hosts.

The script collected sensitive files into a hidden staging directory (/var/tmp/.cpg91511), archived them as /var/tmp/.cpg91511/loot.tgz, and left a backdoor shell at /var/tmp/.cpg91511_sh. Collected material comprised /etc/shadow and /etc/passwd (password hashes), the root MariaDB/MySQL configuration (my.cnf), root shell history, and root SSH authorization and known-hosts files. Exfiltration was performed by uploading the data to OPSSHIELD's own licensing server under a compromised account, from which the attacker retrieved it. In a preliminary update on 2026-11-03 (02:42 AM IST) the vendor reported that 32 files had been retrieved by the attacker from the licensing server. Support-access key removal was initiated at 03:17 AM IST on 2026-11-03.

The attacker's identity is unknown and the source of the credential compromise is still under investigation. No CVE has been assigned; the sources give no CVSS score. Defenders should identify hosts that installed an affected version (grep 'Successfully updated' /opt/cpguard/logs/install_log), hunt for the dropped artifacts, update with 'cpgcli update --start' to 5.88.25 or later (verify with 'cpgcli --version'), reset passwords for root and all password-enabled local accounts from a trusted recovery environment, rotate database credentials, S3 keys, API keys and tokens, and replace SSH private keys in /root/.ssh. The vendor states that a full OS rebuild is not routinely recommended, though this is provisional pending completion of the investigation.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.008 /etc/passwd and /etc/shadow; T1552.003 Shell History

Collection

T1005 Data from Local System; T1074.001 Local Data Staging; T1560.001 Archive via Utility

Execution

T1059.004 Unix Shell

Initial Access

T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain

Defense Evasion

T1564.001 Hidden Files and Directories

Remediation for cPGuard update hijack

Patches

• cPGuard 5.88.25 or later

Immediate actions

• Identify hosts that installed an affected version: grep 'Successfully updated' /opt/cpguard/logs/install_log
• Update cPGuard with 'cpgcli update --start' and verify with 'cpgcli --version' (5.88.25 or later)
• Hunt for and remove /var/tmp/.cpg91511_sh and /var/tmp/.cpg91511 after preserving forensic copies
• Reset passwords for root and all password-enabled local accounts from a trusted recovery environment

Workarounds

• Full OS rebuild is not routinely recommended by the vendor but is provisional pending the completed investigation; consider it for high-value hosts

Longer-term hardening

• Rotate database credentials, S3 keys, API keys and tokens present on affected hosts
• Replace SSH private keys in /root/.ssh and review authorized_keys for unauthorized entries
• Add file-integrity and egress monitoring for security agents running as root
• Stage vendor agent updates and verify signatures where supported

Affected and fixed versions

• OPSSHIELD — cPGuard (cPanel/WHM, DirectAdmin, Plesk, Standalone and other supported platforms)
  Vulnerable versions: 5.88.12; 5.88.13; 5.88.14; 5.88.15; 5.88.16; 5.88.17; 5.88.18; 5.88.19
  Fixed in: 5.88.25 and later

Timeline of cPGuard update hijack

• 2026-11-02 locked-ioc-13 detected the compromise within 12 hours of initial access.
• 2026-11-02 Malicious script locked-ioc-4 distributed through the update channel; cPGuard versions 5.88.12 through 5.88.19 contain the malicious code.
• 2026-11-02 At 02:06 UTC the attacker used compromised credentials to gain unauthorized access to locked-ioc-13's cPGuard update infrastructure (CDN).
• 2026-11-03 locked-ioc-13 published its advisory and The Hacker News reported the compromise; fixed release is 5.88.25 or later.
• 2026-11-03 At 03:17 AM IST locked-ioc-13 initiated removal of support-access keys.
• 2026-11-03 At 02:42 AM IST locked-ioc-13 reported a preliminary investigation update: the attacker retrieved 32 files from the licensing server.

Sources cited for cPGuard update hijack

• OPSSHIELD Advisory: cPGuard Update Channel Compromise opsshield.com · Vendor report · 2026-11-03
• OPSSHIELD Blog opsshield.com · Vendor report
• OPSSHIELD cPGuard Version Help opsshield.com · Vendor report
• MITRE ATT&CK T1195.002 Compromise Software Supply Chain MITRE · Research
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes The Hacker News · News · 2026-11-03

More in supply chain

• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• Haiou Jailbreak Bundle: 'Prompt Adware' Persistently Altering AI Coding Agent Instructions to Promote LLM Gateway (zz.aiapi2025.top)
• XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google
• Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
• Compromised Injective SDK npm Package (@injectivelabs/sdk-ts 1.20.21) Exfiltrates Cryptocurrency Wallet Keys

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages