---
title: Hunt: OPSSHIELD's cPGuard intrusion indicators: attacker IP 94.183.188.91, i9xxxx web shells, a setuid root shell and a hidden gsocket backdoor | ctxsec
url: https://ctxsec.com/items/hunt-opsshield-cpguard-i9xxxx-webshells-gsocket-defunct-iocs
description: "OPSSHIELD published indicators from the intrusion that led to the poisoned cPGuard update. Hosting providers and admins can use them to check cPGuard servers, and any web-facing PHP app that might have been probed the same way."
status: "official (OPSSHIELD incident disclosure IOCs, Nov 3)"
published: 2026-11-04
---

> OPSSHIELD published indicators from the intrusion that led to the poisoned cPGuard update. Hosting providers and admins can use them to check cPGuard servers, and any web-facing PHP app that might have been probed the same way.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-opsshield-cpguard-i9xxxx-webshells-gsocket-defunct-iocs.md)

official (OPSSHIELD incident disclosure IOCs, Nov 3)

2026-11-04

### Hunt: OPSSHIELD's cPGuard intrusion indicators: attacker IP 94.183.188.91, i9xxxx web shells, a setuid root shell and a hidden gsocket backdoor

- **IP:** `94.183.188.91` (main operator address; sometimes used a fake `cPGuard/5.88.11` user agent).
- **Web root:** `/i90248_probe.txt`, `/i90573_probe.txt`, `/i90573_sh.php`, `/i90573_x.php` and any `*_rx.php` endpoints; file names follow an `i9xxxx` pattern.
- **Customer servers:** `/etc/cron.d/i93677`, `/var/tmp/.i93677/`, setuid shell `/var/tmp/.cpg91511_sh`, scripts `cpguard-v58812-i91511*.sh` (SHA-256 `2c2acd988da531d133d0e17f245c49bf15781278f837543d18c95e8410eabd38`, `ffd7a47f65fa1244429baa936ae94be54676b53d2f88bc39564f24e22011de8a`, `d73919af84bf46de941db85e27fd1abc65701ef9ce6cf33bb27c5397f4a41c26`, `6add0201e9a3d02de772d561d05e0da86eb1c538686753b7adcc3aedf7366f77`).
- **Seen on OPSSHIELD's own server (check yours too):** gsocket backdoor `/usr/bin/defunct` with `defunct.service` and `/lib/systemd/system/defunct.dat`, running as `[slub_flushwq]`; a Go implant at `/usr/sbin/pythno3` and related files, running as `[rcu_gp]`; and `/etc/profile.d/gateway.sh`, which hides it from ps, netstat, ls and find. Check from a trusted boot environment or with static binaries.
- Quick check: `find / -xdev -perm -4000 -path '/var/tmp/*' 2>/dev/null` and `ls -la /etc/cron.d /etc/profile.d`.

Sources: [OPSSHIELD: Security Incident Disclosure: manage.opsshield.com (Nov 3)](https://opsshield.com/notice/security-incident-disclosure-servermanage.html)