Friday, April 19, 2024

Avast Shares CCleaner Hack Investigation Report that Reveals Third Stage Payload with Keylogger Capabilities

Avast shared the CCleaner hack investigation report at the Security Analyst Summit in Mexico, researchers said the malware was installed on the built servers of Piriform who developed the CCleaner.

According to Avast report, 2.27 customers installed the altered version of the CCleaner and the malware introduced in Piriform servers sometime between March 11 and July 4, 2017, which is prior to Avast acquisition.

Incident Overview – CCleaner hack

The first stage of the payload that collects user information and controls second stage binary installed in millions of devices, whereas the second-stage installed only in 40 computer out of millions which makes it as the highly targeted attack on sensitive networks.

The third stage of the payload is the ShadowPad that cybercriminals install in the victims’ network to gain remote access.

CCleaner hack
Image Credits: Avast

Avast Says “To eliminate the threat from the Piriform network, we migrated the Piriform build environment to the Avast infrastructure, replaced all hardware and moved the entire Piriform staff onto the Avast-internal IT system.”

With further investigation they found ShadowPad installed in four Piriform computers on April 12th, 2017, possibly stage two downloader downloaded the ShadowPad and C&C servers were shutdown at the time of the investigation.

They also found ShadowPad log files contains encrypted keystrokes from the keylogger installed in the computer back on April 12th, 2017.

By having the tools like shadowpad in the computer attackers can gain complete remote access, record keystrokes and install malicious software on the computer remotely.

Researchers believe Chinese hacker group, Axiom, the group likely behind the CCleaner attack.According to their investigations until today the third stage of payload was not installed on any of the CCleaner customers computers.

We continue investigating the data dumps from the computers, and will post an update as soon as we learn more“, Avast said.


Latest articles

Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums

A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale...

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles