During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. We identified that even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download.
Talos began initial analysis to determine what was causing this technology to flag CCleaner. Upon closer inspection, the executable in question was the installer for CCleaner v5.33, which was being delivered to endpoints by the legitimate CCleaner download servers. On Septemwhile conducting customer beta testing of our new exploit detection technology, Cisco Talos identified a specific executable which was triggering our advanced malware protection systems.
The company is urging users to upgrade to version 5.34 or higher (which it says is available for download here). The affected versions of the software are CCleaner and CCleaner Cloud. The security team at Cisco Talos discovered that download servers used by CCleaners had been compromised to distribute malware inside CCleaner.
0 kommentar(er)
