cPGuard supply-chain compromise — malicious Linux security updates

Threat Overview

A compromised update channel delivered a malicious script, installed a backdoor and collected Linux password hashes, root SSH materials and database configuration. Published artifact names are high-signal but deletion after cleanup can hide prior execution. This is relevant to MSSP customers because compromised externally exposed or trusted software components can enable privileged execution, credential theft or persistence. A matching behavioral signal is not by itself proof of this specific vulnerability.

References

– Vendor/research coverage (November 2026): https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html

Impacted Systems

Linux web-hosting servers running cPGuard affected update releases 5.88.12–5.88.19. Vendor initially listed 5.88.25; later guidance identifies 5.88.26 and subsequent cleanup updates. Install the latest vendor release rather than relying on the first stated fixed build.

Why this matters

Targeted intelligence indicates a credible enterprise exposure or confirmed malicious activity. The queries below are designed for the specific telemetry that may be ingested into Sentinel.

Exploitation Status

OPSSHIELD disclosed a November 2 update-channel compromise and credential collection; updated November 3–4 reporting indicates later cleanup releases and a broader affected population than initial estimates.

What this hunt looks for

No customer workspace was queried. The hunt package defines searches for relevant available Microsoft Sentinel telemetry where the specified data source is ingested; it does not claim a completed review.

Required logs

Required data sources vary by query: Microsoft Sentinel CommonSecurityLog, Syslog, DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents where ingested. Query execution requires the corresponding tables and permissions.

C01 — Known malicious cPGuard update artifacts

DeviceFileEvents | where TimeGenerated >= ago(30d) | where FileName has_any ("cpguard-v58812-i91511.sh","loot.tgz") or FolderPath has_any (".cpg91511_sh",".cpg91511") | project TimeGenerated,DeviceName,ActionType,FileName,FolderPath,InitiatingProcessFileName

C02 — Known artifacts in Linux Syslog

Syslog | where TimeGenerated >= ago(30d) | where SyslogMessage has_any ("cpguard-v58812-i91511.sh",".cpg91511_sh",".cpg91511","loot.tgz") | project TimeGenerated,Computer,ProcessName,SyslogMessage

C03 — cPGuard or updater spawning shell/download tools

DeviceProcessEvents | where TimeGenerated >= ago(30d) | where InitiatingProcessFileName has_any ("cpguard","cpg") or InitiatingProcessCommandLine has_any ("cpguard","cpg91511") | where FileName in~ ("sh","bash","curl","wget","tar","python3","nc") | project TimeGenerated,DeviceName,InitiatingProcessFileName,FileName,ProcessCommandLine,InitiatingProcessCommandLine

C04 — Access to Linux credential and key files

DeviceFileEvents | where TimeGenerated >= ago(30d) | where FolderPath has_any ("/etc/shadow","/root/.ssh/","/etc/passwd") | project TimeGenerated,DeviceName,ActionType,FolderPath,FileName,InitiatingProcessFileName,InitiatingProcessCommandLine

C05 — Sensitive archives in temporary directories

DeviceFileEvents | where TimeGenerated >= ago(30d) | where (FolderPath startswith "/tmp/" or FolderPath startswith "/var/tmp/") and (FileName endswith ".tgz" or FileName endswith ".tar.gz") | project TimeGenerated,DeviceName,ActionType,FolderPath,FileName,InitiatingProcessFileName

C06 — Unusual outbound Linux updater connections

DeviceNetworkEvents | where TimeGenerated >= ago(30d) | where InitiatingProcessFileName in~ ("sh","bash","curl","wget","python3","tar") | where isnotempty(RemoteIP) and not(ipv4_is_private(RemoteIP)) | summarize Connections=count(),FirstSeen=min(TimeGenerated) by DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteIP,RemotePort | order by FirstSeen desc

C07 — Root SSH logons from external sources

Syslog | where TimeGenerated >= ago(30d) | where ProcessName has "sshd" and SyslogMessage has "Accepted" and SyslogMessage has "root" | project TimeGenerated,Computer,SyslogMessage,ProcessName

Detection Notes

Linux EDR file/process events and Syslog are required for direct detection. Without endpoint telemetry, network logs may reveal only external connections and cannot prove that cPGuard was compromised. The first query is the initial triage priority; follow-up queries require analyst correlation with affected-product inventory and normal administrative activity. Broad process/network queries can produce benign results.