[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

official (OPSSHIELD incident disclosure IOCs, Nov 3)

Hunt: OPSSHIELD's cPGuard intrusion indicators: attacker IP 94.183.188.91, i9xxxx web shells, a setuid root shell and a hidden gsocket backdoor

  • IP: 94.183.188.91 (main operator address; sometimes used a fake cPGuard/5.88.11 user agent).
  • Web root: /i90248_probe.txt, /i90573_probe.txt, /i90573_sh.php, /i90573_x.php and any *_rx.php endpoints; file names follow an i9xxxx pattern.
  • Customer servers: /etc/cron.d/i93677, /var/tmp/.i93677/, setuid shell /var/tmp/.cpg91511_sh, scripts cpguard-v58812-i91511*.sh (SHA-256 2c2acd988da531d133d0e17f245c49bf15781278f837543d18c95e8410eabd38, ffd7a47f65fa1244429baa936ae94be54676b53d2f88bc39564f24e22011de8a, d73919af84bf46de941db85e27fd1abc65701ef9ce6cf33bb27c5397f4a41c26, 6add0201e9a3d02de772d561d05e0da86eb1c538686753b7adcc3aedf7366f77).
  • Seen on OPSSHIELD's own server (check yours too): gsocket backdoor /usr/bin/defunct with defunct.service and /lib/systemd/system/defunct.dat, running as [slub_flushwq]; a Go implant at /usr/sbin/pythno3 and related files, running as [rcu_gp]; and /etc/profile.d/gateway.sh, which hides it from ps, netstat, ls and find. Check from a trusted boot environment or with static binaries.
  • Quick check: find / -xdev -perm -4000 -path '/var/tmp/*' 2>/dev/null and ls -la /etc/cron.d /etc/profile.d.

Sources: OPSSHIELD: Security Incident Disclosure: manage.opsshield.com (Nov 3)