Threat reportSupply ChainTL-2026-5229
Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)
Attackers compromised OpsShield's billing/licensing infrastructure, stole an update-storage access key and uploaded fake cPGuard updates (5.88.12-5.88.19) to the update CDN. About 2,950 customer servers ran the malicious script as root, which staged a hidden root shell and exfiltrated credential material, and about 7,900 billing-portal accounts were also exposed.
Key facts for cPGuard OpsShield update hijack
Detection coverage for cPGuard OpsShield update hijack
As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5229 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: TL-2026-5229 Credential Harvest and loot.tgz Archiving on cPGuard Hosts
Detects the collection stage of the malicious cPGuard update: archiving of /etc/shadow, /root/.my.cnf, shell history, SSH private keys/authorized_keys and S3 configs into /var/tmp/.cpg91511/loot.tgz. Classifies which credential material was touched so responders can scope rotation.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1003.008, T1552.003, T1552.004, T1005, T1560.001
- Data sources: linux_auditd, osquery, microsoft_defender_for_endpoint_linux
- Severity: high
- Confidence: high
Splunk SPL
index=linux (sourcetype=linux_audit OR sourcetype=auditd OR sourcetype=osquery:results) earliest=-24h ("loot.tgz" OR ".cpg91511") | eval collected=mvappend(if(match(_raw,"/etc/shadow"),"etc_shadow",null()), if(match(_raw,"[.]my[.]cnf"),"mysql_root_config",null()), if(match(_raw,"bash_history"),"shell_history",null()), if(match(_raw,"id_rsa|id_ed25519|authorized_keys|known_hosts"),"ssh_material",null()), if(match(_raw,"[.]s3cfg|[.]aws/credentials"),"s3_config",null()), if(match(_raw,"loot[.]tgz"),"archive_loot_tgz",null())) | where mvcount(collected)>=1 | stats earliest(_time) as first_seen values(collected) as collected_material count by host, user | convert ctime(first_seen)Microsoft KQL
DeviceProcessEvents | where Timestamp > ago(24h) | where ProcessCommandLine has_any ('loot.tgz', '/var/tmp/.cpg91511') | where FileName in~ ('tar', 'gzip', 'zip', 'cp', 'cat') or ProcessCommandLine has_any ('/etc/shadow', '.my.cnf', '.bash_history', 'id_rsa', 'authorized_keys', '.s3cfg') | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLineSigma
title: TL-2026-5229 cPGuard Credential Harvest Archive loot.tgz
id: 8d3a47f0-91be-4c25-b6d8-2e5f1a09c7a2
status: experimental
description: Detects archiving of credential material (shadow, MySQL root config, SSH keys, history) into the hidden /var/tmp/.cpg91511/loot.tgz archive used by the malicious cPGuard update.
references:
- https://opsshield.com/notice/cpguard-update-channel-compromise.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
- attack.credential-access
- attack.t1003.008
- attack.t1552.003
- attack.t1552.004
- attack.collection
- attack.t1005
- attack.t1560.001
logsource:
category: process_creation
product: linux
detection:
selection_archive:
Image|endswith:
- '/tar'
- '/gzip'
CommandLine|contains: 'loot.tgz'
selection_stage:
CommandLine|contains: '/var/tmp/.cpg91511'
condition: 1 of selection_*
falsepositives:
- Administrators manually archiving files in a directory that happens to be named .cpg91511
level: highKnown false positives:
- Backup or forensic tooling archiving /etc/shadow and SSH keys under a custom path
- IOC-hunting scripts that reference loot.tgz in their command line
Tuning notes: Requires auditd watch rules on /etc/shadow, /root/.my.cnf and /root/.ssh. Because the base search keys on the IOC path, widen to generic tar-of-credentials behaviour only after baselining legitimate backup jobs.
- TL-2026-5229 Attacker Probe and Webshell File Requests (i90573 / [indicator]) · unlock with TL Creds
- TL-2026-5229 Hidden Root Shell and Cron Persistence (.cpg91511_sh, cron.d/i93677) · unlock with TL Creds
- TL-2026-5229 Exfiltration of loot.tgz via curl/wget to [indicator] · unlock with TL Creds
- TL-2026-5229 Spoofed cPGuard User Agent / Attacker IP Against Billing Callbacks · unlock with TL Creds
- TL-2026-5229 gsocket Backdoor, Go Implant and Process-Hiding Persistence · unlock with TL Creds
- TL-2026-5229 gsocket (defunct) Backdoor Process Execution and Relay C2 · unlock with TL Creds
- TL-2026-5229 cPGuard Malicious Update Script Execution (5.88.12-5.88.19) · unlock with TL Creds
- TL-2026-5229 Network Traffic to Attacker IP [indicator] · unlock with TL Creds
Indicators of compromise for cPGuard OpsShield update hijack
As of 2026-11-04, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-5229.
Sample indicators (3 of 24)
- IP address:
94.183.188[.]91 - Domain:
manage[.]opsshield[.]com - File hash:
2c2acd988da531d133d0e17f245c49bf15781278f837543d18c95e8410eabd38
Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.
How cPGuard OpsShield update hijack works
OpsShield, the vendor of the cPGuard Linux web-hosting security suite, disclosed on 3 November 2026 that its update channel had been abused to push malicious updates. According to OpsShield's security report, the attacker began probing the billing portal (manage.opsshield.com) on 1 November 2026 at 15:38 UTC, registered an account under a false identity at 16:34 UTC and ordered a free cPGuard trial. The trial was installed on an attacker-controlled server at 21:17 UTC to study the client's communication with the licensing infrastructure. cPGuard flagged and banned the attacker twice (21:40-21:51 UTC). At 22:50 UTC the attacker sent crafted requests to billing callback pages and at 22:58 UTC achieved command execution on the billing/licensing server. OpsShield could not recover the exact request because it was not logged; it identified and patched two potential entry points in the billing code. The attacker used the primary IP 94.183.188.91 with a spoofed 'cPGuard/5.88.11' user agent.
Using data and an access key obtained from the compromised server, the attacker uploaded a fake cPGuard update to the update CDN between 02:04 and 02:09 UTC on 2 November 2026 (OpsShield's advisory gives the launch as 02:06 UTC). The fake update was served as versions 5.88.12 through 5.88.19 and deployed to roughly 2,950 customer servers between about 02:08 and 03:20 UTC (about 70 minutes) before being detected within roughly 12 hours. The malicious update script (cpguard-v58812-i91511.sh and variants b, c and d) ran as root, created a hidden root shell at /var/tmp/.cpg91511_sh and a collection directory /var/tmp/.cpg91511, and packed collected files into /var/tmp/.cpg91511/loot.tgz. Collected material included /etc/shadow and /etc/passwd, the root MySQL/MariaDB config (/root/.my.cnf), root shell history, SSH private keys, authorized_keys and known_hosts, and on a subset S3 cloud storage configs. The archives were uploaded to a compromised licensing-server account, and the attacker retrieved about 32 collected files from customer servers. The report also lists a persistence artifact, a cron entry at /etc/cron.d/i93677 with files in /var/tmp/.i93677/, and probe/webshell files such as /i90248_probe.txt, /i90573_probe.txt, /i90573_sh.php and /i90573_x.php, plus *_rx.php exfiltration endpoints. The cPGuard license private and public keys were also compromised. At 02:13 UTC on 2 November the attacker cloned three OpsShield cloud servers.
On OpsShield's own infrastructure (not customer servers) the attacker left a gsocket backdoor (/usr/bin/defunct and defunct.service), Go implant copies (/usr/sbin/pythno3, /usr/sbin/netstat.cfg and others) and a process-hiding script (/etc/profile.d/gateway.sh). About 7,900 billing-portal accounts (names, companies, postal addresses, emails, bcrypt-hashed passwords) were copied. OpsShield published a clean update (v5.88.26) and follow-up patch, revoked the stolen key and all cloud API tokens, removed attacker SSH keys and cloud snapshots, reissued all license keys, reset billing sessions and is rebuilding the billing, licensing and management servers. No CVE has been assigned, and no threat actor has been named in the sources reviewed. Customers must update to a fixed version (5.88.25 or later per SecurityWeek), rotate every root and user password, SSH key, MySQL root password and S3 credential, audit authorized_keys, and rebuild servers if the attacker accessed them manually. Severity HIGH is an analyst judgment, since the sources provide no CVSS score.
MITRE ATT&CK techniques by tactic:
Credential Access
T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow; T1552.003 Shell History; T1552.004 Unsecured Credentials: Private Keys
Collection
T1005 Data from Local System; T1560.001 Archive Collected Data: Archive via Utility
Persistence
T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Defense Evasion
Remediation for cPGuard OpsShield update hijack
Patches
- Update cPGuard to 5.88.25 or later (OpsShield clean update v5.88.26 and follow-up patch)
Immediate actions
- Run 'cpgcli update --start' and verify 'cpgcli --version' reports a fixed release (5.88.25 or later; clean build 5.88.26 published by OpsShield)
- Check /opt/cpguard/logs/install_log with: grep 'Successfully updated' /opt/cpguard/logs/install_log to identify installation of versions 5.88.12-5.88.19
- Hunt for /var/tmp/.cpg91511_sh, /var/tmp/.cpg91511/, /var/tmp/.cpg91511/loot.tgz, /var/tmp/.i93677/ and /etc/cron.d/i93677 and delete confirmed artifacts
- Treat all password hashes, root SSH keys, MySQL root passwords and shell-history credentials on exposed servers as compromised and rotate them from a trusted recovery environment
- Block outbound and inbound traffic to 94.183.188.91
Workarounds
- Rotate MySQL/MariaDB root credentials, API tokens and database credentials
- Monitor /var/tmp for hidden dot-files and /etc/cron.d for unexpected entries
Longer-term hardening
- Rebuild servers where the attacker may have interacted manually
- Reset the OpsShield billing portal password and enable 2FA
- Reset S3 or other cloud storage configurations present on affected servers
- Audit /root/.ssh/authorized_keys and generate new SSH key pairs
- Verify integrity and signatures of vendor-delivered update scripts before execution and restrict root-run auto-updates
Affected and fixed versions
- OpsShield — cPGuard (Linux web hosting security suite)
Vulnerable versions: 5.88.12; 5.88.13; 5.88.14; 5.88.15; 5.88.16; 5.88.17; 5.88.18; 5.88.19
Fixed in: 5.88.25 and later; 5.88.26 (clean update) - OpsShield — OpsShield billing portal (manage.opsshield.com) accounts
Vulnerable versions: About 7,900 customer accounts exposed
Fixed in: Billing, licensing and management servers rebuilt by vendor
Timeline of cPGuard OpsShield update hijack
- 22:50 UTC: crafted requests sent to billing callback pages; 22:58 UTC: command execution achieved on the billing/licensing server.
- 21:17 UTC: trial installed on an attacker-controlled server to study licensing communications; cPGuard flags and bans the attacker twice between 21:40 and 21:51 UTC.
- 15:38 UTC: attacker begins probing the OpsShield billing portal (locked-ioc-10); 16:34 UTC registers an account under a false identity and orders a free cPGuard trial.
- Compromise detected within about 12 hours of the malicious update; stolen key revoked and clean update v5.88.26 published.
- 02:08-03:20 UTC: malicious update (5.88.12-5.88.19) executed as root on roughly 2,950 customer servers for about 70 minutes; 02:13 UTC three OpsShield cloud servers cloned by the attacker.
- 02:04-02:09 UTC: fake cPGuard update uploaded to the update CDN using a stolen access key (advisory gives attack launch at 02:06 UTC).
- OpsShield publishes the incident notice and detailed security report; entry point traced to the billing application and two potential entry points patched; support keys removal notice issued.
- SecurityWeek reports the supply chain attack, citing about 2,950 affected servers and about 7,900 exposed customer records.
Sources cited for cPGuard OpsShield update hijack
- OpsShield incident notice: cPGuard update channel compromise opsshield.com · Vendor report · 2026-11-03
- OpsShield security incident disclosure (manage.opsshield.com billing/licensing compromise) opsshield.com · Vendor report · 2026-11-03
- cPGuard change logs (OpsShield help center) opsshield.com · Vendor report
- Technology & Development partnership with OpsShield (cPGuard) - malware.expert malware.expert · Blog
- Malicious cPGuard Updates Served in OpsShield Supply Chain Attack SecurityWeek · News · 2026-11-04
Further reading
Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.
