Earlier this week, when the CCleaner hack was reported, researchers assured users that there's no bit phase malware used inward the massive assail together with affected users tin only update their version inward companionship to top away rid of the malicious software.
However, during the analysis of the hackers' command-and-control (C2) server to which the malicious CCleaner versions connected, safety researchers from Cisco's Talos Group found bear witness of a bit payload (GeeSetup_x86.dll, a lightweight backdoor module) that was delivered to a specific listing of computers based on local domain names.
Affected Technology Firms
According to a predefined listing mentioned inward the configuration of the C2 server, the assail was designed to detect computers within the networks of the major applied scientific discipline firms together with deliver the secondary payload. The target companies included:
- Microsoft
- Cisco
- Intel
- Samsung
- Sony
- HTC
- Linksys
- D-Link
- Akamai
- VMware
The CCleaner hackers specifically chose these xx machines based upon their Domain name, IP address, together with Hostname. The researchers believe the secondary malware was probable intended for industrial espionage.
CCleaner Malware Links to Chinese Hacking Group
According to the researchers from Kaspersky, the CCleaner malware shares or together with then code amongst the hacking tools used past times a sophisticated Chinese hacking grouping called Axiom, also known equally APT17, Group 72, DeputyDog, Tailgater Team, Hidden Lynx or AuroraPanda.
"The malware injected into #CCleaner has shared code amongst several tools used past times ane of the APT groups from the #Axiom APT 'umbrella'," tweeted manager of Global Research together with Analysis Team at Kaspersky Lab.Cisco researchers also Federal Reserve annotation that ane configuration file on the attacker's server was laid for China's fourth dimension zone, which suggests PRC could hold upward the source of the CCleaner attack. However, this bear witness lone is non plenty for attribution.
Cisco Talos researchers also said that they convey already notified the affected tech companies nearly a possible breach.
Removing Malicious CCleaner Version would Not Help
Just removing the Avast's software application from the infected machines would non hold upward plenty to top away rid of the CCleaner bit phase malware payload from their network, amongst the attackers' still-active C2 server.
So, affected companies that convey had their computers infected amongst the malicious version of CCleaner are strongly recommended to fully restore their systems from backup versions earlier the installation of the tainted safety program.
"These findings also back upward together with reinforce our previous recommendation that those impacted past times this render chain assail should non only take away the affected version of CCleaner or update to the latest version, but should restore from backups or reimage systems to ensure that they completely take away non exclusively the backdoored version of CCleaner but also whatever other malware that may hold upward resident on the system," the researchers say.For those who are unaware, the Windows 32-bit version of CCleaner v5.33.6162 together with CCleaner Cloud v1.07.3191 were affected past times the malware, together with affected users should update the software to version 5.34 or higher.
