Ccleaner Malware Infects Big Tech Companies Amongst 2D Backdoor

The grouping of unknown hackers who hijacked CCleaner's download server to distribute a malicious version of the pop organization optimization software targeted at to the lowest degree xx major international applied scientific discipline companies alongside a second-stage payload.

Earlier this week, when the CCleaner hack was reported, researchers assured users that there's no minute phase malware used inwards the massive assail in addition to affected users tin merely update their version inwards club to become rid of the malicious software.

However, during the analysis of the hackers' command-and-control (C2) server to which the malicious CCleaner versions connected, safety researchers from Cisco's Talos Group found bear witness of a minute payload (GeeSetup_x86.dll, a lightweight backdoor module) that was delivered to a specific listing of computers based on local domain names.

Affected Technology Firms 

According to a predefined listing mentioned inwards the configuration of the C2 server, the assail was designed to discovery computers within the networks of the major applied scientific discipline firms in addition to deliver the secondary payload. The target companies included:

• Google
• Microsoft
• Cisco
• Intel
• Samsung
• Sony
• HTC
• Linksys
• D-Link
• Akamai
• VMware

In the database, researchers flora a listing of nearly 700,000 backdoored machines infected alongside the malicious version of CCleaner, i.e. the first-stage payload, in addition to a listing of at to the lowest degree xx machines that were infected alongside the secondary payload to become a deeper foothold on those systems.

The CCleaner hackers specifically chose these xx machines based upon their Domain name, IP address, in addition to Hostname. The researchers believe the secondary malware was probable intended for industrial espionage.

CCleaner Malware Links to Chinese Hacking Group

According to the researchers from Kaspersky, the CCleaner malware shares unopen to code alongside the hacking tools used past times a sophisticated Chinese hacking grouping called Axiom, also known equally APT17, Group 72, DeputyDog, Tailgater Team, Hidden Lynx or AuroraPanda.

"The malware injected into #CCleaner has shared code alongside several tools used past times 1 of the APT groups from the #Axiom APT 'umbrella'," tweeted managing director of Global Research in addition to Analysis Team at Kaspersky Lab.

Cisco researchers also banker's complaint that 1 configuration file on the attacker's server was laid for China's fourth dimension zone, which suggests Red People's Republic of China could last the source of the CCleaner attack. However, this bear witness lone is non plenty for attribution.

Cisco Talos researchers also said that they accept already notified the affected tech companies virtually a possible breach.

Removing Malicious CCleaner Version would Not Help

Just removing the Avast's software application from the infected machines would non last plenty to become rid of the CCleaner minute phase malware payload from their network, alongside the attackers' still-active C2 server.

So, affected companies that accept had their computers infected alongside the malicious version of CCleaner are strongly recommended to fully restore their systems from backup versions earlier the installation of the tainted safety program.

"These findings also back upward in addition to reinforce our previous recommendation that those impacted past times this render chain assail should non merely take the affected version of CCleaner or update to the latest version, but should restore from backups or reimage systems to ensure that they completely take non alone the backdoored version of CCleaner but also whatever other malware that may last resident on the system," the researchers say.

For those who are unaware, the Windows 32-bit version of CCleaner v5.33.6162 in addition to CCleaner Cloud v1.07.3191 were affected past times the malware, in addition to affected users should update the software to version 5.34 or higher.

Share This :