Attackers compromised OPSSHIELD’s cPGuard update system, distributing a backdoor and data-collection file through versions 5.88.12–5.88.19.
OPSSHIELD confirmed at least 32 customer-linked files were stolen; the number of affected servers is unknown.
Versions 5.88.25 and later remove the malicious file and backdoor.
What happened
The malicious file that was installed was able to steal important information, such as passwords, database settings, and command history of administrators on their computers. It also created a permanent “backdoor” that allowed the attackers to access the system. This information was sent to OPSSHIELD’s own server because the attackers had previously compromised a company account.
OPSSHIELD realized what was happening and stopped distributing the file within 12 hours of the attack starting. Although the company confirmed the theft of at least 32 files involving customers, it is not yet known how many computers in total have been affected.
What you have to do
If you are using cPGuard, the company has released version 5.88.25 (and later), which removes the dangerous file and backdoor. However, upgrading alone is not enough, as the stolen data can be used by the attackers.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Google warns: Attacks on corporate AI accounts resulted in over $100.000 in charges in one day
↗
If your computer was running one of the problematic versions, you should do the following:
- Install the latest version of cPGuard.
- Change all passwords of the system.
- Change all digital keys and codes used for databases, services, or logging into your server.
- Check your security settings., as the company also releases an update to remove its own support keys from customer servers.
OPSSHIELD is investigating the incident and urges users who have doubts to contact the company's support.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)