Malware

CCBkdr

CCBkdr is a backdoor associated with the CCleaner software supply-chain compromise. It was inserted into a legitimate signed release of CCleaner and distributed through the vendor’s official distribution channel, allowing the malware to reach downstream users under the guise of trusted software. The malware is known to support command-and-control resiliency through a domain generation algorithm used as a fallback channel when communication with its primary command-and-control infrastructure is disrupted. This combination of trusted software distribution and resilient command-and-control made CCBkdr notable as a supply-chain-delivered backdoor affecting Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.002Compromise Software Supply ChainEvidence2

During the 3CX Supply Chain Attack, AppleJeus first compromised an "end-of-life" trading software application which was downloaded and executed inside the 3CX enterprise environment. The second compromise modified the Windows and macOS build environments used to distribute the 3CX software to their customer base.

Command and Control

2 techniques

T1008Fallback ChannelsEvidence1

CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost. CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.

T1568.002Domain Generation AlgorithmsEvidence3

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attack websiteNews

Jul 8, 2020

Dynamic Resolution: Domain Generation Algorithms, Sub-technique T1568.002 - Enterprise | MITRE ATT&CK®

Backdoor malware that can use a domain generation algorithm as a fallback command-and-control channel.

mitre attack websiteNews

Mar 15, 2018

Supply Chain Compromise: Compromise Software Supply Chain, Sub-technique T1195.002 - Enterprise | MITRE ATT&CK®

Backdoor inserted into a legitimate signed CCleaner release and distributed via the official distribution site as part of a supply chain compromise.

mitre attack websiteNews

Aug 7, 2017

Dynamic Resolution: Domain Generation Algorithms, Sub-technique T1568.002 - Enterprise | MITRE ATT&CK®

Backdoor malware that can use a domain generation algorithm as a fallback command-and-control channel.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CCBkdr