# cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)

> An unidentified attacker used compromised credentials to access OPSSHIELD's cPGuard update infrastructure on 2026-11-02 and pushed a malicious update script (cpguard-v58812-i91511.sh) to Linux servers. The script staged a backdoor shell and harvested /etc/shadow, /etc/passwd, root MariaDB/MySQL config, root shell history and SSH files, uploading them to OPSSHIELD's licensing server under a compromised account. cPGuard 5.88.12 through 5.88.19 are affected; 5.88.25 and later are fixed.

- **Published:** 2026-11-03T16:15:23Z
- **Last reviewed:** 2026-11-03T16:15:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5162
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5162.png
- **ID:** TL-2026-5162
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

On 2026-11-02 at 02:06 UTC an attacker used compromised credentials to gain unauthorized access to the update delivery infrastructure (described in the vendor advisory as OPSSHIELD's CDN) for cPGuard, a commercial server security product for Linux hosting environments. Per the vendor, the compromise was detected within 12 hours.

The attacker distributed a malicious shell script named cpguard-v58812-i91511.sh through the legitimate update channel. Versions 5.88.12 through 5.88.19 (inclusive) contain the malicious code. Because cPGuard runs with root privileges on cPanel/WHM, DirectAdmin, Plesk, standalone and other supported platforms, the script executed with full privileges on updating hosts.

The script collected sensitive files into a hidden staging directory (/var/tmp/.cpg91511), archived them as /var/tmp/.cpg91511/loot.tgz, and left a backdoor shell at /var/tmp/.cpg91511_sh. Collected material comprised /etc/shadow and /etc/passwd (password hashes), the root MariaDB/MySQL configuration (my.cnf), root shell history, and root SSH authorization and known-hosts files. Exfiltration was performed by uploading the data to OPSSHIELD's own licensing server under a compromised account, from which the attacker retrieved it. In a preliminary update on 2026-11-03 (02:42 AM IST) the vendor reported that 32 files had been retrieved by the attacker from the licensing server. Support-access key removal was initiated at 03:17 AM IST on 2026-11-03.

The attacker's identity is unknown and the source of the credential compromise is still under investigation. No CVE has been assigned; the sources give no CVSS score. Defenders should identify hosts that installed an affected version (grep 'Successfully updated' /opt/cpguard/logs/install_log), hunt for the dropped artifacts, update with 'cpgcli update --start' to 5.88.25 or later (verify with 'cpgcli --version'), reset passwords for root and all password-enabled local accounts from a trusted recovery environment, rotate database credentials, S3 keys, API keys and tokens, and replace SSH private keys in /root/.ssh. The vendor states that a full OS rebuild is not routinely recommended, though this is provisional pending completion of the investigation.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1564.001 Hidden Files and Directories
- T1003.008 /etc/passwd and /etc/shadow
- T1552.003 Shell History
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1560.001 Archive via Utility

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**cPGuard Backdoor Credential Harvest, Staging and loot.tgz Archive (Splunk) — Post-Exploitation** (`TL-2026-5162-SPL-002`)

Detects the collection phase of the cPGuard supply-chain script: staging in the hidden directory /var/tmp/.cpg91511, archiving to loot.tgz, and bulk access to /etc/shadow, /etc/passwd, root my.cnf, /root/.bash_history and /root/.ssh/authorized_keys|known_hosts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.008, T1552.003, T1005, T1074.001, T1560.001
- **Data sources:** linux_auditd, microsoft_defender_for_endpoint_linux, sysmon_for_linux
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux (sourcetype=linux_audit OR sourcetype=auditd) ("/var/tmp/.cpg91511" OR "loot.tgz" OR "/etc/shadow")
| eval staging=if(match(_raw,"/var/tmp/[.]cpg91511") OR match(_raw,"loot[.]tgz"),1,0), shadow=if(match(_raw,"/etc/shadow"),1,0), history=if(match(_raw,"/root/[.]bash_history"),1,0), mycnf=if(match(_raw,"my[.]cnf"),1,0), sshfiles=if(match(_raw,"/root/[.]ssh/(authorized_keys|known_hosts)"),1,0)
| bin _time span=10m
| stats sum(staging) as staging sum(shadow) as shadow sum(history) as history sum(mycnf) as mycnf sum(sshfiles) as sshfiles by host _time
| eval sensitive_sets=(shadow>0)+(history>0)+(mycnf>0)+(sshfiles>0)
| where staging>0 OR sensitive_sets>=3
```

### Microsoft KQL

```kql
let lookback = 7d;
union
(DeviceProcessEvents
 | where Timestamp > ago(lookback)
 | where ProcessCommandLine has_any ("/var/tmp/.cpg91511", "loot.tgz")
     or (FileName in~ ("tar", "gzip", "cp", "zip") and ProcessCommandLine has "/etc/shadow"
         and ProcessCommandLine has_any ("/root/.bash_history", "my.cnf", "authorized_keys", "known_hosts"))
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, Source = "process"),
(DeviceFileEvents
 | where Timestamp > ago(lookback)
 | where FolderPath has "/var/tmp/.cpg91511" or FileName =~ "loot.tgz"
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName = InitiatingProcessAccountName, Source = "file")
| order by Timestamp desc
```

### Sigma

```yaml
title: cPGuard Backdoor Credential Harvest, Staging and loot.tgz Archive
id: 8c4e7f20-3a91-4b5d-8e66-2f1d7a9c5b02
status: experimental
description: Detects the collection phase of the cPGuard supply chain script, staging in /var/tmp/.cpg91511, archiving to loot.tgz and bulk access to /etc/shadow with root history, my.cnf and SSH files
references:
    - https://opsshield.com/notice/cpguard-update-channel-compromise.html
    - https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html
    - https://attack.mitre.org/techniques/T1003/008/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.credential-access
    - attack.t1003.008
    - attack.t1552.003
    - attack.collection
    - attack.t1005
    - attack.t1074.001
    - attack.t1560.001
logsource:
    category: process_creation
    product: linux
detection:
    selection_loot:
        CommandLine|contains:
            - '/var/tmp/.cpg91511'
            - 'loot.tgz'
    selection_tool:
        Image|endswith:
            - '/tar'
            - '/cp'
            - '/gzip'
            - '/zip'
    selection_shadow:
        CommandLine|contains: '/etc/shadow'
    selection_other:
        CommandLine|contains:
            - '/root/.bash_history'
            - 'my.cnf'
            - 'authorized_keys'
            - 'known_hosts'
    condition: selection_loot or (selection_tool and selection_shadow and selection_other)
falsepositives:
    - Backup or migration scripts that archive /etc/shadow together with /root dotfiles and my.cnf
    - Administrators copying account files during server migration
level: high

```

**Known false positives:**

- Full-server backup or cPanel/WHM account-migration jobs that archive /etc/shadow with root config files
- Administrators copying account databases between hosts during maintenance

**Tuning notes:** Allow-list known backup/migration job command lines and service accounts. The loot.tgz and .cpg91511 branches are high fidelity; the multi-file branch is behavioural and can be tightened by requiring the parent to be a shell spawned from /opt/cpguard. Add auditd -w watch rules on /etc/shadow, /root/.bash_history, /root/.ssh and my.cnf so reads are logged.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- cPGuard Trojanized Update Script and Backdoor Shell Execution (Sentinel/Defender KQL) — Exploitation (locked: unlock with TL Creds)
- cPGuard Backdoor Credential Harvest, Staging and [indicator] Archive (Sentinel/Defender KQL) — Post-Exploitation (locked: unlock with TL Creds)
- cPGuard Exfiltration to OPSSHIELD Licensing Server via Script or CLI Client (Sentinel/Defender KQL) — C2 / Exfiltration (locked: unlock with TL Creds)
- cPGuard Trojanized Update Script and Backdoor Shell Execution (Sigma) — Exploitation (locked: unlock with TL Creds)
- cPGuard Backdoor Credential Harvest, Staging and [indicator] Archive (Sigma) — Post-Exploitation (locked: unlock with TL Creds)
- cPGuard Exfiltration to OPSSHIELD Licensing Server via Script or CLI Client (Sigma) — C2 / Exfiltration (locked: unlock with TL Creds)
- cPGuard Trojanized Update Script and Backdoor Shell Execution (Splunk) — Exploitation (locked: unlock with TL Creds)
- cPGuard Exfiltration to OPSSHIELD Licensing Server via Script or CLI Client (Splunk) — C2 / Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes](https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html)
- [OPSSHIELD Advisory: cPGuard Update Channel Compromise](https://opsshield.com/notice/cpguard-update-channel-compromise.html)
- [OPSSHIELD Blog](https://opsshield.com/blog)
- [OPSSHIELD cPGuard Version Help](https://opsshield.com/help/?p=828)
- [MITRE ATT&CK T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5162