cPGuard Supply Chain Compromise: Detection and Remediation Guide for Poisoned Updates

---
title: cPGuard Update Process Anomalous Network Activity
id: 8f4e2a91-3b7c-4d5e-9a1f-2c8d7e6f5a4b
status: experimental
description: Detects cPGuard processes making unexpected network connections to non-standard infrastructure, potentially indicating poisoned update communication with C2 servers.
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1195
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'cpguard'
      - 'cpsrvd'
  filter_ports:
    DestinationPort:
      - 443
      - 80
  filter_domains:
    DestinationHostname|contains:
      - 'opsshield.com'
      - 'cpguard.net'
  condition: selection and not filter_ports and not filter_domains
falsepositives:
  - Legitimate cPGuard updates to vendor infrastructure
  - Local security scanning activity
level: high
---
title: Suspicious Process Execution Following cPGuard Update
id: 3d7f9e21-5a8b-4c6d-8e2f-1a9c4b7d6e3f
status: experimental
description: Detects execution of suspicious child processes spawned by cPGuard services, indicating potential post-exploitation activity following a compromised update.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1543.002
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
      - 'cpguard'
      - 'cpsrvd'
    Image|endswith:
      - 'bash'
      - 'sh'
      - 'curl'
      - 'wget'
      - 'nc'
      - 'python'
      - 'perl'
falsepositives:
  - Legitimate administrative scripts executed during updates
  - System maintenance tasks
level: critical
---
title: cPGuard Update Binary Modification
id: 6b2a8f34-9c1d-4e7f-3a5b-8d9e2f1a6c4b
status: experimental
description: Detects unauthorized modifications to cPGuard binaries and update components outside of official update windows.
references:
  - https://attack.mitre.org/techniques/T1554/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1554
  - attack.t1195
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/usr/local/cpguard/'
      - '/opt/cpguard/'
      - 'cpguard'
    Image|endswith:
      - 'cp'
      - 'mv'
      - 'rm'
      - 'chmod'
      - 'chown'
  filter_legitimate:
    Image|contains:
      - 'cpguard'
      - 'yum'
      - 'apt'
      - 'rpm'
      - 'dpkg'
  condition: selection and not filter_legitimate
falsepositives:
  - Manual administrative updates
  - Automated configuration management tools
level: high

// Hunt for suspicious process execution following cPGuard updates
let timeframe = ago(14d);
let cpguard_processes = dynamic(["cpguard", "cpsrvd", "cpscanner"]);
Syslog
| where TimeGenerated > timeframe
| where ProcessName in~ (cpguard_processes)
| extend ParsedMessage = parse SyslogMessage with * "exe=" ExecutablePath " cmd=" CommandLine
| extend ExecutablePath = tostring(ExecutablePath), CommandLine = tostring(CommandLine)
| where isnotempty(ExecutablePath) and isnotempty(CommandLine)
| where CommandLine has_any ("bash", "sh", "curl", "wget", "nc", "python", "perl")
| project TimeGenerated, Computer, ProcessName, ExecutablePath, CommandLine, HostIP
| join kind=leftouter (
    Syslog
    | where TimeGenerated > timeframe
    | where SyslogMessage has "cpguard" and SyslogMessage has "update"
    | project UpdateTime=TimeGenerated, Computer, UpdateMessage=SyslogMessage
) on Computer
| extend TimeFromUpdate = datetime_diff('minute', TimeGenerated, UpdateTime)
| where TimeFromUpdate <= 60 and TimeFromUpdate >= 0
| sort by TimeGenerated desc

-- Hunt for cPGuard processes and their child processes for post-exploitation analysis
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, 
       PPID, 
       (SELECT Name FROM pslist(pid=PPID)) AS ParentProcess
FROM pslist()
WHERE Name =~ 'cpguard|cpsrvd|cpscanner'
   OR CommandLine =~ 'cpguard'
   OR Exe =~ '/usr/local/cpguard/|/opt/cpguard/'
ORDER BY CreateTime DESC

-- Hunt for suspicious network connections from cPGuard processes
SELECT Pid, Name, RemoteAddr, RemotePort, Status, 
       (SELECT CommandLine FROM pslist(pid=Pid)) AS CommandLine
FROM netstat()
WHERE Name =~ 'cpguard|cpsrvd'
   AND RemoteAddr !~ '^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'
   AND RemotePort !~ '^(80|443|53|123)$'

#!/bin/bash
# cPGuard Supply Chain Compromise - Detection and Remediation Script
# Security Arsenal - 2026-04-06

set -euo pipefail

# Configuration
CPGUARD_PATHS=("/usr/local/cpguard" "/opt/cpguard" "/usr/local/cpanel/3rdparty/cpguard")
LOG_FILE="/var/log/cpguard_remediation_$(date +%Y%m%d_%H%M%S).log"
BACKUP_DIR="/root/cpguard_backup_$(date +%Y%m%d_%H%M%S)"

# Logging function
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Check if running as root
if [[ $EUID -ne 0 ]]; then
   log "ERROR: This script must be run as root"
   exit 1
fi

log "Starting cPGuard compromise detection and remediation"

# Create backup directory
mkdir -p "$BACKUP_DIR"
log "Backup directory created: $BACKUP_DIR"

# Function to check file integrity
check_file_integrity() {
    local file_path="$1"
    local expected_hash="$2"
    
    if [[ -f "$file_path" ]]; then
        local actual_hash=$(sha256sum "$file_path" | cut -d' ' -f1)
        if [[ "$actual_hash" != "$expected_hash" ]]; then
            log "WARNING: Hash mismatch for $file_path"
            log "  Expected: $expected_hash"
            log "  Actual:   $actual_hash"
            return 1
        fi
    else
        log "WARNING: File not found: $file_path"
        return 1
    fi
    return 0
}

# Detect cPGuard installation
CPGUARD_FOUND=false
for path in "${CPGUARD_PATHS[@]}"; do
    if [[ -d "$path" ]]; then
        log "Found cPGuard installation at: $path"
        CPGUARD_FOUND=true
        CPGUARD_DIR="$path"
        break
    fi
done

if [[ "$CPGUARD_FOUND" == false ]]; then
    log "No cPGuard installation detected. Exiting."
    exit 0
fi

# Backup current cPGuard installation
log "Backing up cPGuard installation..."
cp -r "$CPGUARD_DIR" "$BACKUP_DIR/"
log "Backup completed: $BACKUP_DIR/cpguard"

# Check for suspicious modifications in the last 30 days
log "Checking for recently modified cPGuard files..."
find "$CPGUARD_DIR" -type f -mtime -30 -exec ls -la {} \; >> "$LOG_FILE" 2>&1

# Check for suspicious processes
log "Checking for suspicious cPGuard processes..."
ps aux | grep -E "(cpguard|cpsrvd)" | grep -v grep >> "$LOG_FILE" 2>&1

# Check network connections
log "Checking network connections from cPGuard processes..."
netstat -tulpn 2>/dev/null | grep -E "(cpguard|cpsrvd)" >> "$LOG_FILE" 2>&1 || true
ss -tulpn 2>/dev/null | grep -E "(cpguard|cpsrvd)" >> "$LOG_FILE" 2>&1 || true

# Check for persistence mechanisms
log "Checking for suspicious persistence mechanisms..."
find /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly -name "*cpguard*" -type f >> "$LOG_FILE" 2>&1
ls -la /etc/systemd/system/ | grep -i cpguard >> "$LOG_FILE" 2>&1 || true
ls -la /etc/init.d/ | grep -i cpguard >> "$LOG_FILE" 2>&1 || true

# Stop cPGuard services
log "Stopping cPGuard services..."
systemctl stop cpguard 2>/dev/null || true
systemctl stop cpsrvd 2>/dev/null || true
pkill -f cpguard 2>/dev/null || true
pkill -f cpsrvd 2>/dev/null || true
sleep 5

# Disable cPGuard services
log "Disabling cPGuard services..."
systemctl disable cpguard 2>/dev/null || true
systemctl disable cpsrvd 2>/dev/null || true

# Remove potentially compromised binaries
log "Removing potentially compromised binaries..."
rm -rf "$CPGUARD_DIR/bin" 2>/dev/null || true
rm -rf "$CPGUARD_DIR/lib" 2>/dev/null || true
rm -rf "$CPGUARD_DIR/sbin" 2>/dev/null || true

# Download and install clean cPGuard version
log "Downloading clean cPGuard installation..."
cd /tmp
if command -v curl &> /dev/null; then
    curl -L -o cpguard-clean.tar.gz "https://downloads.cpguard.net/latest/cpguard-latest.tar.gz"
elif command -v wget &> /dev/null; then
    wget -O cpguard-clean.tar.gz "https://downloads.cpguard.net/latest/cpguard-latest.tar.gz"
else
    log "ERROR: Neither curl nor wget available for download"
    exit 1
fi

# Verify download integrity (placeholder - replace with actual hash from vendor)
log "Verifying download integrity..."
# EXPECTED_HASH="REPLACE_WITH_OFFICIAL_HASH_FROM_VENDOR"
# if ! check_file_integrity "cpguard-clean.tar.gz" "$EXPECTED_HASH"; then
#     log "ERROR: Download verification failed. Aborting installation."
#     exit 1
# fi

# Extract and install clean version
log "Installing clean cPGuard version..."
tar -xzf cpguard-clean.tar.gz
if [[ -d "cpguard-install" ]]; then
    cd cpguard-install
    bash install.sh --force
    log "Clean cPGuard installation completed"
else
    log "ERROR: Installation directory not found after extraction"
    exit 1
fi

# Restart services
log "Restarting cPGuard services..."
systemctl daemon-reload
systemctl enable cpguard
systemctl start cpguard

# Verify installation
log "Verifying installation..."
if systemctl is-active --quiet cpguard; then
    log "SUCCESS: cPGuard service is running"
else
    log "WARNING: cPGuard service may not be running properly"
fi

# Clean up
log "Cleaning up temporary files..."
cd /
rm -rf /tmp/cpguard-clean.tar.gz /tmp/cpguard-install

# Final recommendations
log ""
log "=== REMEDIATION COMPLETE ==="
log ""
log "IMPORTANT NEXT STEPS:"
log "1. Review the log file: $LOG_FILE"
log "2. Check the backup directory: $BACKUP_DIR"
log "3. Monitor for suspicious activity in the next 24-48 hours"
log "4. Rotate all credentials used on this system"
log "5. Review authentication logs for unauthorized access"
log "6. Consider rebuilding the system if compromise is confirmed"
log "7. Contact OpsShield support for incident verification"
log ""
log "For additional support, contact Security Arsenal"