Threat video1:00
cPGuard OPSSHIELD Update Hijack: Detection & IOCs
Attackers pushed a malicious cPGuard update that backdoors Linux servers and steals password hashes: 16 IOCs, 9 detection rules, and a free Splunk SPL rule.
Read the full threat intel for cPGuard OPSSHIELD Update Hijack: Detection & IOCs →
Chapters
- 0:00The hookHackers backdoored cPGuard updates to harvest root credentials.
- 0:05The storyCredentials compromised, update channel hijacked.
- 0:13Attack pathStolen credentials exposed the update channel.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromise13 indicators to hunt: 3 file names, 9 paths and 1 package name.
- 0:39MITRE ATT&CK techniques9 ATT&CK techniques, from initial access to collection.
- 0:44Remediation4 steps now: Identify hosts that installed an affected version.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Hackers backdoored cPGuard updates to harvest root credentials.
0:05Credentials compromised, update channel hijacked.
0:08As root, script harvested passwords and SSH keys.
0:13Stolen credentials exposed the update channel.
0:16The malicious script ran as root.
0:18Passwords, hashes, and SSH files harvested.
0:22All data uploaded to licensing servers.
0:25A backdoor shell was installed.
0:29No threat actor is attributed. Confidence: low.
0:3313 indicators to hunt: 3 file names, 9 paths and 1 package name.
0:399 ATT&CK techniques, from initial access to collection.
0:444 steps now: Identify hosts that installed an affected version.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.