cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
Summary
An attacker compromised the update channel for the cPGuard security tool, distributing a malicious script to customer Linux servers. This script installed a backdoor and exfiltrated sensitive data, including password hashes.
IFF Assessment
FOE
The compromise of a security tool's update channel to deploy backdoors and steal sensitive data represents a significant win for attackers and a setback for defenders.
Defender Context
This incident highlights the critical importance of supply chain security, even for security software itself. Defenders should remain vigilant for unexpected behavior from trusted software updates and ensure robust monitoring and incident response plans are in place to detect and mitigate such compromises.