Avast shared the CCleaner hack investigation report at the Security Analyst Summit in Mexico, researchers said the malware was installed on the built servers of Piriform who developed the CCleaner.
According to Avast report, 2.27 customers installed the altered version of the CCleaner and the malware introduced in Piriform servers sometime between March 11 and July 4, 2017, which is prior to Avast acquisition.
The first stage of the payload that collects user information and controls second stage binary installed in millions of devices, whereas the second-stage installed only in 40 computer out of millions which makes it as the highly targeted attack on sensitive networks.
The third stage of the payload is the ShadowPad that cybercriminals install in the victims’ network to gain remote access.
Avast Says “To eliminate the threat from the Piriform network, we migrated the Piriform build environment to the Avast infrastructure, replaced all hardware and moved the entire Piriform staff onto the Avast-internal IT system.”
With further investigation they found ShadowPad installed in four Piriform computers on April 12th, 2017, possibly stage two downloader downloaded the ShadowPad and C&C servers were shutdown at the time of the investigation.
They also found ShadowPad log files contains encrypted keystrokes from the keylogger installed in the computer back on April 12th, 2017.
By having the tools like shadowpad in the computer attackers can gain complete remote access, record keystrokes and install malicious software on the computer remotely.
Researchers believe Chinese hacker group, Axiom, the group likely behind the CCleaner attack.According to their investigations until today the third stage of payload was not installed on any of the CCleaner customers computers.
“We continue investigating the data dumps from the computers, and will post an update as soon as we learn more“, Avast said.
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…
