An OPNsense firewall running version 26.7.1_1 experienced severe performance degradation due to high CPU usage by php-cgi processes. Investigation revealed that these processes were spawned by a backdoor injected into the system.inc configuration file via cron.
The malicious entry in the crontab was traced back to a modification of the /usr/local/etc/inc/system.inc file. Unlike standard OPNsense updates, this change was not present on a secondary node in the same cluster, confirming it was an unauthorized alteration.
The security team identified the breach using the pkg check --checksums --all command, which flagged a checksum mismatch for the system.inc file. The backdoor was manually removed by editing the file and restarting the cron service.
The investigation into the source of the breach proved inconclusive due to the use of a shared root password among staff and the lack of external logging. The attacker could have potentially cleared local logs, leaving no audit trail of the unauthorized access.
Following the incident, the organization plans to implement personalized access controls, disable direct root logins, and set up remote log replication. They also intend to deploy File Integrity Monitoring (FIM) systems to detect unauthorized modifications in real time.
