# Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)

> Attackers compromised OpsShield's billing/licensing infrastructure, stole an update-storage access key and uploaded fake cPGuard updates (5.88.12-5.88.19) to the update CDN. About 2,950 customer servers ran the malicious script as root, which staged a hidden root shell and exfiltrated credential material, and about 7,900 billing-portal accounts were also exposed.

- **Published:** 2026-11-04T11:18:28Z
- **Last reviewed:** 2026-11-04T11:18:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5229
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5229.png
- **ID:** TL-2026-5229
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

OpsShield, the vendor of the cPGuard Linux web-hosting security suite, disclosed on 3 November 2026 that its update channel had been abused to push malicious updates. According to OpsShield's security report, the attacker began probing the billing portal (manage.opsshield.com) on 1 November 2026 at 15:38 UTC, registered an account under a false identity at 16:34 UTC and ordered a free cPGuard trial. The trial was installed on an attacker-controlled server at 21:17 UTC to study the client's communication with the licensing infrastructure. cPGuard flagged and banned the attacker twice (21:40-21:51 UTC). At 22:50 UTC the attacker sent crafted requests to billing callback pages and at 22:58 UTC achieved command execution on the billing/licensing server. OpsShield could not recover the exact request because it was not logged; it identified and patched two potential entry points in the billing code. The attacker used the primary IP 94.183.188.91 with a spoofed 'cPGuard/5.88.11' user agent.

Using data and an access key obtained from the compromised server, the attacker uploaded a fake cPGuard update to the update CDN between 02:04 and 02:09 UTC on 2 November 2026 (OpsShield's advisory gives the launch as 02:06 UTC). The fake update was served as versions 5.88.12 through 5.88.19 and deployed to roughly 2,950 customer servers between about 02:08 and 03:20 UTC (about 70 minutes) before being detected within roughly 12 hours. The malicious update script (cpguard-v58812-i91511.sh and variants b, c and d) ran as root, created a hidden root shell at /var/tmp/.cpg91511_sh and a collection directory /var/tmp/.cpg91511, and packed collected files into /var/tmp/.cpg91511/loot.tgz. Collected material included /etc/shadow and /etc/passwd, the root MySQL/MariaDB config (/root/.my.cnf), root shell history, SSH private keys, authorized_keys and known_hosts, and on a subset S3 cloud storage configs. The archives were uploaded to a compromised licensing-server account, and the attacker retrieved about 32 collected files from customer servers. The report also lists a persistence artifact, a cron entry at /etc/cron.d/i93677 with files in /var/tmp/.i93677/, and probe/webshell files such as /i90248_probe.txt, /i90573_probe.txt, /i90573_sh.php and /i90573_x.php, plus *_rx.php exfiltration endpoints. The cPGuard license private and public keys were also compromised. At 02:13 UTC on 2 November the attacker cloned three OpsShield cloud servers.

On OpsShield's own infrastructure (not customer servers) the attacker left a gsocket backdoor (/usr/bin/defunct and defunct.service), Go implant copies (/usr/sbin/pythno3, /usr/sbin/netstat.cfg and others) and a process-hiding script (/etc/profile.d/gateway.sh). About 7,900 billing-portal accounts (names, companies, postal addresses, emails, bcrypt-hashed passwords) were copied. OpsShield published a clean update (v5.88.26) and follow-up patch, revoked the stolen key and all cloud API tokens, removed attacker SSH keys and cloud snapshots, reissued all license keys, reset billing sessions and is rebuilding the billing, licensing and management servers. No CVE has been assigned, and no threat actor has been named in the sources reviewed. Customers must update to a fixed version (5.88.25 or later per SecurityWeek), rotate every root and user password, SSH key, MySQL root password and S3 credential, audit authorized_keys, and rebuild servers if the attacker accessed them manually. Severity HIGH is an analyst judgment, since the sources provide no CVSS score.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1053.003 Scheduled Task/Job: Cron
- T1543.002 Create or Modify System Process: Systemd Service
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
- T1552.003 Shell History
- T1552.004 Unsecured Credentials: Private Keys
- T1005 Data from Local System
- T1560.001 Archive Collected Data: Archive via Utility

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5229 Credential Harvest and loot.tgz Archiving on cPGuard Hosts** (`TL-2026-5229-SPL-002`)

Detects the collection stage of the malicious cPGuard update: archiving of /etc/shadow, /root/.my.cnf, shell history, SSH private keys/authorized_keys and S3 configs into /var/tmp/.cpg91511/loot.tgz. Classifies which credential material was touched so responders can scope rotation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.008, T1552.003, T1552.004, T1005, T1560.001
- **Data sources:** linux_auditd, osquery, microsoft_defender_for_endpoint_linux
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux (sourcetype=linux_audit OR sourcetype=auditd OR sourcetype=osquery:results) earliest=-24h ("loot.tgz" OR ".cpg91511") | eval collected=mvappend(if(match(_raw,"/etc/shadow"),"etc_shadow",null()), if(match(_raw,"[.]my[.]cnf"),"mysql_root_config",null()), if(match(_raw,"bash_history"),"shell_history",null()), if(match(_raw,"id_rsa|id_ed25519|authorized_keys|known_hosts"),"ssh_material",null()), if(match(_raw,"[.]s3cfg|[.]aws/credentials"),"s3_config",null()), if(match(_raw,"loot[.]tgz"),"archive_loot_tgz",null())) | where mvcount(collected)>=1 | stats earliest(_time) as first_seen values(collected) as collected_material count by host, user | convert ctime(first_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents | where Timestamp > ago(24h) | where ProcessCommandLine has_any ('loot.tgz', '/var/tmp/.cpg91511') | where FileName in~ ('tar', 'gzip', 'zip', 'cp', 'cat') or ProcessCommandLine has_any ('/etc/shadow', '.my.cnf', '.bash_history', 'id_rsa', 'authorized_keys', '.s3cfg') | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: TL-2026-5229 cPGuard Credential Harvest Archive loot.tgz
id: 8d3a47f0-91be-4c25-b6d8-2e5f1a09c7a2
status: experimental
description: Detects archiving of credential material (shadow, MySQL root config, SSH keys, history) into the hidden /var/tmp/.cpg91511/loot.tgz archive used by the malicious cPGuard update.
references:
    - https://opsshield.com/notice/cpguard-update-channel-compromise.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.credential-access
    - attack.t1003.008
    - attack.t1552.003
    - attack.t1552.004
    - attack.collection
    - attack.t1005
    - attack.t1560.001
logsource:
    category: process_creation
    product: linux
detection:
    selection_archive:
        Image|endswith:
            - '/tar'
            - '/gzip'
        CommandLine|contains: 'loot.tgz'
    selection_stage:
        CommandLine|contains: '/var/tmp/.cpg91511'
    condition: 1 of selection_*
falsepositives:
    - Administrators manually archiving files in a directory that happens to be named .cpg91511
level: high
```

**Known false positives:**

- Backup or forensic tooling archiving /etc/shadow and SSH keys under a custom path
- IOC-hunting scripts that reference loot.tgz in their command line

**Tuning notes:** Requires auditd watch rules on /etc/shadow, /root/.my.cnf and /root/.ssh. Because the base search keys on the IOC path, widen to generic tar-of-credentials behaviour only after baselining legitimate backup jobs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5229 Attacker Probe and Webshell File Requests (i90573 / [indicator]) (locked: unlock with TL Creds)
- TL-2026-5229 Hidden Root Shell and Cron Persistence (.cpg91511_sh, cron.d/i93677) (locked: unlock with TL Creds)
- TL-2026-5229 Exfiltration of loot.tgz via curl/wget to [indicator] (locked: unlock with TL Creds)
- TL-2026-5229 Spoofed cPGuard User Agent / Attacker IP Against Billing Callbacks (locked: unlock with TL Creds)
- TL-2026-5229 gsocket Backdoor, Go Implant and Process-Hiding Persistence (locked: unlock with TL Creds)
- TL-2026-5229 gsocket (defunct) Backdoor Process Execution and Relay C2 (locked: unlock with TL Creds)
- TL-2026-5229 cPGuard Malicious Update Script Execution (5.88.12-5.88.19) (locked: unlock with TL Creds)
- TL-2026-5229 Network Traffic to Attacker IP [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `94.183.188[.]91`
- Domain: `manage[.]opsshield[.]com`
- File hash: `2c2acd988da531d133d0e17f245c49bf15781278f837543d18c95e8410eabd38`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malicious cPGuard Updates Served in OpsShield Supply Chain Attack](https://www.securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack/)
- [OpsShield incident notice: cPGuard update channel compromise](https://opsshield.com/notice/cpguard-update-channel-compromise.html)
- [OpsShield security incident disclosure (manage.opsshield.com billing/licensing compromise)](https://opsshield.com/notice/security-incident-disclosure-servermanage.html)
- [cPGuard change logs (OpsShield help center)](https://opsshield.com/help/cpguard/category/change-logs)
- [Technology & Development partnership with OpsShield (cPGuard) - malware.expert](https://malware.expert/tag/development/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5229