{
  "type": "bundle",
  "id": "bundle--6a46f49a-d0d8-587d-8a3f-941c62cb3844",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--7b7a9df3-3487-56b3-8b8d-e8c7eeda4ac0",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "org:c155c238-5d94-4e7b-b648-d04b0fc4e60b",
      "name": "OPSSHIELD",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--58b8e8ff-7c44-5b18-82ac-75180437996d",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "inc:0837950b-c1dc-4e74-a58e-62a8638313ce",
      "name": "OpsShield cPGuard update compromise"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c8db0b22-d08f-5ee2-8a0b-5e5c3a2bfd1a",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "brh:e9766da3-99ec-4073-9fe8-e30467dc7bbe",
      "name": "OpsShield cPGuard update compromise"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10a1da22-e5b1-5f50-8307-d981545e1fc3",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:9e963a3f-740b-449b-ad10-95609516acad",
      "relationship_type": "resulted-in",
      "source_ref": "incident--58b8e8ff-7c44-5b18-82ac-75180437996d",
      "target_ref": "x-ally-event--98b650e3-19e4-5989-80c8-ecf9bb915286",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:f874e9c0-be0b-4fd4-b1fe-d1653f0a1221",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--298a9762-24c8-55a5-8fad-af0b0219bf33",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:e242c818-617a-4341-a0c8-1aac70ad3c30",
      "relationship_type": "resulted-in",
      "source_ref": "incident--58b8e8ff-7c44-5b18-82ac-75180437996d",
      "target_ref": "x-ally-event--51bfc21e-5f14-5599-896c-9c010200eaf1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:7b393a2a-a87b-4f30-9ea9-0eae3f2511f6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3acb6324-6f45-5c4a-8ace-51158412a48a",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:4c8850bc-a4d4-4752-ba84-6f3f9f969a46",
      "relationship_type": "resulted-in",
      "source_ref": "incident--58b8e8ff-7c44-5b18-82ac-75180437996d",
      "target_ref": "x-ally-event--d86c432f-30ff-5d41-8eca-ebb334ab4305",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:0157b828-2e3a-4f9e-8609-480bbf0130fe",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f6d9891-db46-532b-8cb1-d649225b5e35",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:e11c42aa-eefa-4480-946e-f4380746ca4a",
      "relationship_type": "affected-organization",
      "source_ref": "incident--58b8e8ff-7c44-5b18-82ac-75180437996d",
      "target_ref": "identity--7b7a9df3-3487-56b3-8b8d-e8c7eeda4ac0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:93d2ac84-b236-42a5-9c9a-3dfec3fca8e0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0ae64c65-ff03-5aa0-8bda-f70238706265",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:ab3c7b98-d917-417d-9e5f-fffb00b148d5",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1003/008/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--19873ad5-f1ff-5ae5-80ff-ea9b0e5a4299",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:4c1e6fb0-2d98-4646-8bc5-e62de071b8c6",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:23430894-7809-40e2-8567-b6bb74382b0d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The attacker registered a trial account and reached command execution through the billing application. OPSSHIELD could not identify the exact request and patched two possible entry points."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1eb6a7b3-80ed-585d-861a-e8111645515e",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:a4652a3d-2bd5-4fb2-9e5b-8d4d7f6a1db3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:52329dd2-000d-4598-b24f-2244bb09dfa1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The vendor estimated that about 2,950 customer servers ran the update and approximately 7,900 billing-account records were copied. Those are separate server and account measures, not a count of people."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--45c5566a-4ea7-5681-804c-cfa144c28951",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:3a555818-1f13-4401-b7d2-5c7b2e2281b4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:3eeaa478-5f88-450c-a8e0-a7e78445e6b7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-02"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--54067faf-f117-5afc-83b9-8c3e96c9b378",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:29e929ab-c78c-486e-a310-2fff4190e19d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/cpguard-update-channel-compromise.html",
          "external_id": "cit:957222c3-5148-4d41-b338-3a514dd5dcc1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dde76c9bf2479c6876e7a9ce65e3a043edbbb2869e576803db3e93a1308f9e62"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The earlier advisory estimated that the attacker retrieved 32 uploaded files, each associated with one customer server. This preliminary retrieval measure is different from the later estimate of servers that ran the update."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5b7b8347-a1be-5b38-88e3-a05d4c255f2d",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:e510c9ab-f996-481b-98ff-58fba64a6bda",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:d2d3631b-4a0c-44a7-9895-98d2d6a0974b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-03"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7012635c-8b23-5af4-8b3a-aa7bdf93b76c",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:d376746e-bab3-4d65-80c8-8f12191f3e29",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:d5d94b7a-c6e2-435d-a07e-11c2ce024dd1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The malicious update ran as root and left a hidden privileged shell and scheduled task. The vendor placed update execution between 02:08 and 03:20 UTC on November 2."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--773c550b-030c-58de-860c-bd591f00878a",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:afe1b5c0-a7cb-4f9a-9c84-db815d388530",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1552/004/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--78487c33-dde9-5b44-8284-b22a8d753c56",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:d07f58ef-1197-4207-8a53-de93fae0a241",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:160ba86c-a3d0-4d3d-a335-859430cb1350",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-03"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7bb1d42d-4e1d-5d4b-8fcc-7b28ad88a29d",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:4341e8a8-37e9-494d-8afc-51360907d65f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:a9b8ee2f-7179-4be7-80ba-2177b0027546",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OPSSHIELD revoked keys, reset sessions, rotated its own credentials and began rebuilding affected systems. Its later report names clean version 5.88.26 and directs customers to update, rotate exposed secrets and check related systems."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a3c30ac6-f065-5f62-8572-f75362726350",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:d372b4fe-34a6-425e-bee5-cae501856c5a",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1195/002/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b35ef95a-5e55-54cd-8941-dce8cb776bc5",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:1f176153-93e6-47b7-afad-eec35740fd3e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:e904ba58-5466-4302-a718-c916d1f01316",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OPSSHIELD said an attacker compromised its billing and licensing system on November 1, 2026, then used a stolen publishing key to distribute malicious cPGuard updates on November 2."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cafc3fde-f7fd-54ed-8585-3d73806cbfde",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:1de997fc-357c-49a6-abd2-a0f1c4dd1702",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:b82a7788-dd3c-4fd5-9e5b-8c900296db1d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Collected material included local password hashes, root SSH keys, database credentials, shell history and some cloud-storage keys. Billing records included contacts and bcrypt password hashes."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f6817177-fa74-50ef-82fe-409cc7f5df1f",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:a71e56a7-5fc5-40bd-9351-2bb6936b2bc8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OPSSHIELD",
          "url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
          "external_id": "cit:6d596137-ad30-4515-8382-da1d1ca7915c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c152ed6b1e7ea8d1b26100ac42e4e315e5b996122f23a6b2d722a1f04c8ac965"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-01"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--51bfc21e-5f14-5599-896c-9c010200eaf1",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "evt:d5f764b4-cca4-42c7-aec8-3c58e2663607",
      "name": "Malicious update distributed and key revoked"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--98b650e3-19e4-5989-80c8-ecf9bb915286",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "evt:306b5b96-b7f4-4b07-9ecc-7be656f65352",
      "name": "Billing server compromised"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--d86c432f-30ff-5d41-8eca-ebb334ab4305",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "evt:c86e7036-983d-4ffc-a2dc-cc73205e5b21",
      "name": "Incident findings published"
    }
  ]
}