Threat video1:00
cPGuard Fake Updates Hit 2,950 Servers: Detection & IOCs
Fake cPGuard updates on OpsShield's CDN ran as root on about 2,950 servers; hunt them with 9 detection rules, 24 IOCs and a free Splunk SPL rule.
Read the full threat intel for cPGuard Fake Updates Hit 2,950 Servers: Detection & IOCs →
Chapters
- 0:00The hookSupply chain strike: about 2,950 servers.
- 0:04The storyThey breached the billing server.
- 0:10Attack pathAccording to OpsShield, billing was breached.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise20 indicators to hunt: 1 IP, 4 SHA-256 hashes and 1 file name, and more.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to collection.
- 0:43Remediation5 steps now: Run 'cpgcli update --start' and verify 'cpgcli --version' reports.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Supply chain strike: about 2,950 servers.
0:05They breached the billing server.
0:06Then poisoned the update CDN.
0:11According to OpsShield, billing was breached.
0:13Update key stolen, fake version uploaded.
0:16Malicious update deployed on nearly 3,000 servers.
0:20Harvested credentials, planted hidden shell.
0:25No threat actor is attributed. Confidence: low.
0:3020 indicators to hunt: 1 IP, 4 SHA-256 hashes and 1 file name, and more.
0:3812 ATT&CK techniques, from initial access to collection.
0:435 steps now: Run 'cpgcli update --start' and verify 'cpgcli --version' reports.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.