The company disclosed that, between November 1 and 2, attackers were able to gain unauthorized access to the OpsShield update distribution infrastructure, and, for about 70 minutes, pushed out a malicious update.
The threat actors began by probing OpsShield’s billing portal, registering a customer account under a false identity, and ordering a free cPGuard trial. They then sent crafted requests that allowed them to gain the ability to run commands on the server to collect data. They used stolen access keys to publish fake updates that ran as root (the highest level of admin privilege), and to copy sensitive files and make copies of three OpsShield cloud servers.
About 2,950 customer servers ran the fake update, exposing password hashes, root SSH keys, MySQL root passwords, and shell history, OpsShield reported. Attackers also accessed about 7,900 billing portal accounts containing customer names, addresses, emails, and hashed passwords.
