The Indian cybersecurity company "OpsShield," specializing in server protection and web security software, was subjected to a dual cyberattack targeting its update distribution infrastructure. The attack resulted in the broadcasting of malicious versions of the popular web server protection tool "cPGuard" to the company's customers within a short time window.
According to investigations and notices issued by the company, the attackers began by breaching its billing and licensing server by registering a new customer account and studying the communication mechanism with the licensing system, which enabled them to execute commands and extract data before using a stolen access key to upload a fake update containing malicious code.
This attack affected versions 5.88.12 to 5.88.19 of the "cPGuard" tool, which continued to be distributed for approximately 70 minutes before the security vulnerability was discovered within 12 hours of its occurrence. Estimates indicate that about 2,950 servers executed the fake update, while attackers managed to copy data for approximately 7,900 customer account records, including names, companies, addresses, email addresses, and encrypted passwords.
What are the practical implications of this breach?
The malicious script caused several tasks to be executed on the affected customer servers, including collecting data and uploading it to the compromised licensing server, creating a hidden Root Shell, and placing additional files in the Temp folder. The attackers succeeded in retrieving 32 aggregated files from various customer servers, as well as copying three of the company's cloud servers.
In light of these data, the company recommended that all root SSH keys, MySQL database passwords, command logs, and billing portal passwords be considered fully compromised, with the necessity of rotating and changing them immediately, even for customers whose servers were not connected at the time of the incident.
Corrective Measures and Company Response
OpsShield has taken a series of strict measures to contain the breach, including:
- Expelling attackers from all affected servers and resetting internal secrets and credentials.
- Removing attackers' SSH keys and assets cloned from cloud accounts.
- Reissuing all public and private license keys for the cPGuard software.
- Terminating all billing portal login sessions and rotating API keys.
- Rebuilding the billing, licensing, and internal management servers from scratch.
- Launching new clean versions of the software (version 5.88.25 and later) to remove the remaining root shell and hidden files.