The affected version of the utility contains a modified _scrt_common_main_seh function that routes the execution flow to a custom function meant to decode and load the malware. Technical Analysis CCleanerĬCleaner is a PC cleaning utility developed by Piriform, which was recently acquired by antivirus (AV) provider Avast in June 2017. The report also outlines the potential for additional adversary tactics, techniques and procedures (TTPs). (More information on targeted industries is available for CrowdStrike customers in our Falcon Intelligence™ portal.) CrowdStrike’s threat intelligence team had also previously reported on the malware’s C2 (command and control) infrastructure in a recent alert for CrowdStrike customers identifying possible links to Aurora Panda. A popular PC optimization tool, the 5.33 version of CCleaner has had widespread distribution across multiple industries, but the embedded code appeared to actually be targeted at specific groups in the technology sector. To help inform the user community and empower them to better defend against software supply chain attacks, the CrowdStrike® Security Response Team (SRT) conducted a thorough analysis of the CCleaner backdoor. The recent backdoor that was discovered embedded in the legitimate, signed version of CCleaner 5.33, is just such an attack. However, threat researchers have another definition: To them, supply chain attacks can also denote the growing phenomenon in which malicious code is injected into new releases and updates of legitimate software packages, effectively turning an organization’s own software supply infrastructure into a potent and hard-to-prevent attack vector. A well-known retail chain’s massive breach in 2013 is a classic example: Adversaries used a poorly protected HVAC vendor as their gateway to hack into the giant retailer’s enterprise network. To the general business community, it refers to attacks targeting vulnerable third-parties in a larger organization’s supply chain. The term “supply chain attacks” means different things to different people.

Ccleaner piriform software ltd