Avast Shares CCleaner Hack Investigation Report that Reveals Third Stage Payload with Keylogger Capabilities

Avast shared the CCleaner hack investigation report at the Security Analyst Summit in Mexico, researchers said the malware was installed on the built servers of Piriform who developed the CCleaner.

According to Avast report, 2.27 customers installed the altered version of the CCleaner and the malware introduced in Piriform servers sometime between March 11 and July 4, 2017, which is prior to Avast acquisition.

Incident Overview – CCleaner hack

The first stage of the payload that collects user information and controls second stage binary installed in millions of devices, whereas the second-stage installed only in 40 computer out of millions which makes it as the highly targeted attack on sensitive networks.

The third stage of the payload is the ShadowPad that cybercriminals install in the victims’ network to gain remote access.

Avast Says “To eliminate the threat from the Piriform network, we migrated the Piriform build environment to the Avast infrastructure, replaced all hardware and moved the entire Piriform staff onto the Avast-internal IT system.”

With further investigation they found ShadowPad installed in four Piriform computers on April 12th, 2017, possibly stage two downloader downloaded the ShadowPad and C&C servers were shutdown at the time of the investigation.

They also found ShadowPad log files contains encrypted keystrokes from the keylogger installed in the computer back on April 12th, 2017.

By having the tools like shadowpad in the computer attackers can gain complete remote access, record keystrokes and install malicious software on the computer remotely.

Researchers believe Chinese hacker group, Axiom, the group likely behind the CCleaner attack.According to their investigations until today the third stage of payload was not installed on any of the CCleaner customers computers.

“We continue investigating the data dumps from the computers, and will post an update as soon as we learn more“, Avast said.