2017 CCleaner Attack may have had a Third Phase

Posted on March 14, 2018 at 7:59 AM

2017 CCleaner Attack may have had a Third Phase

Last year, CCleaner was hacked, and infected with malware. The software that was supposed to be keeping millions of users safe, was indeed leaving the backdoor open to cybercriminals. When Avast acquired Piriform and did the routine upgrading and checking of their newly purchased network, they found a two-phase attack embedded in the network, with a possible third phase in the making.

Newly Acquired Problems

It’s any cybersecurity company’s worst nightmare. The software that thousands of users rely on to protect them has been hacked, leaving users vulnerable. CCleaner, versions V5.33.6162 and Cloud V1.07.3191 had been infected with malware last fall. These programs are installed on over 2.25 million computers, now vulnerable to keylogging, data collection, and activity monitoring. The maker, Avast, has been working hard to uncover how and why this happened on their network. They have discovered 40 machines on their network that also have versions of malware with downloader capability.

When Avast acquired Piriform, the original maker of CrapCleaner, in July of last year, they had no idea this type of issue would soon be on their hands. In August, the malware was discovered, and teams began unraveling what had happened. According to researchers at Avast and Kaspersky Lab, it is believed that Chinese cyber espionage group Axiom is behind the attack. The malware was initially spread on the Piriform network between March and July of 2017.

Remote control access on the Piriform network

Researchers have found two solid phases of the attack, and have an inkling about what a third phase might’ve been, had the attack gone unchecked. While they have not found third stage binary on any machines to date, they have found older versions of the first and second stage binary. In these older versions, 4 machines were being directed to download something called ShadowPad. ShadowPad was installed on those 4 machines in April of last year. ShadowPad is a malware that allows for the remote takeover of a machine, as well as keylogging and data stealing.

The software was first discovered in August of last year when researchers at Kaspersky discovered a backdoor in NetSarang’s server management package. According to Kaspersky Lab, ShadowPad is able to execute random code, create processes, and maintain a virtual file of the system registry. These activities are all stored in encrypted locations unique to each target. At this time, it is not clear if the CCleaner attack was meant to infect all 40 Piriform machines with ShadowPad, but researchers will continue investigating and keep us up to date.

The version of ShadowPad that has been discovered seems to have been custom built for Piriform. Attackers would have been able to collect all necessary login credentials and any operations behaviors of the targeted machine. In addition to keylogger tools, the hackers also installed a password stealer and tools with the ability to install more software and plugins. Had Avast not caught this invasion, the issue could have gotten much worse than it is, and the nightmare could’ve ended CCleaner altogether.

Summary
2017 CCleaner Attack may have had a Third Phase
Article Name
2017 CCleaner Attack may have had a Third Phase
Description
Last year, CCleaner was hacked, and infected with malware. The software that was supposed to be keeping millions of users safe, was indeed leaving the backdoor open to cybercriminals.
Author
Publisher Name
Koddos
Publisher Logo

Share this:

Related Stories:

Newsletter

Get the latest stories straight
into your inbox!

YOUTUBE

Discover more from KoDDoS Blog

Subscribe now to keep reading and get access to the full archive.

Continue reading