Ccleaner malware issue software#
Ccleaner malware issue code#

The complex code is heavily obfuscated and uses anti-debugging and anti-emulation tricks to conceal its inner workings. The second stage appears to use a completely different control network. Again, because the data covers only a small fraction of the time the backdoor was active, both Avast and Talos believe the true number of targets and victims was much bigger. The 20 computers that installed the payload were from eight of those targeted organizations, Avast said, without identifying which ones.

Of 700,000 infected PCs, 20 of them, belonging to highly targeted companies, received the second stage, according to an analysis published Wednesday by Cisco Systems' Talos Group.īecause the CCleaner backdoor was active for 31 days, the total number of infected computers is 'likely at least in the order of hundreds,' researchers from Avast, the antivirus company that acquired CCleaner in July, said in their own analysis published Thursday.įrom September 12 to September 16, the highly advanced second stage was reserved for computers inside 20 companies or Web properties, including Cisco, Microsoft, Gmail, VMware, Akamai, Sony, and Samsung. The new evidence-culled from data left on a command-and-control server during the last four days attackers operated it-shows otherwise. In addition to being installed on more than 2 million systems, the CCleaner malware is dangerous because it can place a backdoor on infected systems that appears legitimate because it is signed with one of Piriform's own digital certificates.TalosPreviously, researchers found no evidence that any of the computers infected by the booby-trapped version of the widely used CCleaner utility had received a second-stage payload the backdoor was capable of delivering.

Ccleaner malware issue software#

However, enterprises that didn't have the software auto-updated needed to manually remove it from the impacted systems. From the nearly 2.27 million systems that installed the impacted CCleaner, only 40 systems were infected, and most of the systems that installed the impacted CCleaner got an auto-update from Avast that removed the malicious version - showing one perk of auto-updates.

Morphisec notified Avast of suspicious connections from CCleaner, prompting an investigation.Īny time an enterprise is notified of an attack that it didn't internally detect, it is a bit concerning, but not surprising. Given that CCleaner is used so widely, it's a target for a watering hole attack.Ī recent watering hole attack was disclosed in detail by Avast Software, Morphisec and Cisco, and it described how an attacker was able to gain access to Piriform Software Ltd.'s software development environment to add malware to the legitimate CCleaner software - Avast acquired Piriform last summer. CCleaner software is usually only installed on a few endpoints in an enterprise, but the organization could lose track of the software.

Sometimes, the help desk will use tools to investigate an endpoint that may have been infected with malware, and one of those tools is CCleaner. Some software may be managed by the enterprise, some may be used by the help desk to fix systems, and some may be used by employees without the knowledge or approval of the enterprise IT department. One common security recommendation is to know what software or systems your enterprise is using so that you know what needs to be secured. Software and supply chain security are critical parts of an enterprise's information security program.