Loading story…
Attackers compromised Piriform’s software production environment and distributed a malicious, validly signed build of CCleaner 5.33.6162—and affected CCleaner Cloud 1.07—to about 2.27 million systems between mid-August and mid-September 2017. Investigations by Avast, Talos, and Morphisec found the backdoored binary executed malicious code early in process initialization, performed host reconnaissance, contacted command-and-control infrastructure, and could receive additional payloads while using anti-debugging, reflective loading, and other evasion techniques. Avast revoked the signing certificate and released clean updates, first 5.34 and later 5.35, while urging users to upgrade and scan affected machines.
The compromise was later confirmed as a targeted espionage operation rather than indiscriminate malware distribution. Server logs and follow-on analysis showed second-stage malware was delivered to a small set of selected victims—initially reported as 20 machines across 8 organizations, later expanded to 40 PCs across 11 companies including Samsung, Sony, Asus, Intel, VMware, O2, Singtel, Gauselmann, Dyn, Chunghwa, and Fujitsu. Avast said the attackers had entered Piriform months earlier through TeamViewer access to a developer workstation, then moved laterally with RDP, credential theft, a keylogger, and ShadowPad until they reached a build server. Researchers noted code overlaps with activity previously associated with APT17, but said the evidence was insufficient for firm attribution.
Trace attribution and downstream blast radius.
19 events from the most recent confirmed update back to the earliest known activity.
Avast published new findings showing the attackers first accessed Piriform's network on March 11, 2017 via TeamViewer on a developer workstation, then moved laterally, used a keylogger, and deployed ShadowPad to four systems including a build server before the malicious CCleaner release.
Avast found a ShadowPad sample uploaded from South Korea to VirusTotal on December 27, 2017, configured to communicate with command-and-control servers hosted at Konkuk University.
Avast found a ShadowPad executable targeting a Russian organization involved in distributing public budgets; the sample was submitted to VirusTotal on November 3, 2017, with a related submission from China on November 6.
Avast Threat Labs released additional technical findings on September 22, 2017, covering the command-and-control server, second-stage payload structure, targeting changes, and inconclusive attribution clues including similarities to APT17-linked malware.
Avast reported that analysis of seized server data showed the CCleaner compromise was a targeted APT campaign and that a second-stage payload had been delivered to selected victims. It said 20 machines across 8 organizations appeared in a little over three days of logs and that the true number was likely higher.
Cisco Talos published its report on the CCleaner incident on September 18, 2017, publicly documenting the malware-tainted distribution of the software.
Avast said the malicious CCleaner 5.33.6162 build affected about 2.27 million computers between August 15 and September 15, 2017, marking the end of the known exposure window.
Avast said Cisco sent it a message about the CCleaner threat on September 14, 2017, after Morphisec's earlier notification.
On September 12, 2017, the attackers erased and reinstalled MariaDB and mariadb-server 5.5.52 on the command-and-control server after the earlier database failure.
Avast said it first learned of the possible malware from Morphisec on September 12, 2017, and a clean CCleaner 5.34 release was issued the same day to replace the compromised version.
Morphisec said some customers shared logs of the prevented malicious CCleaner activity with it on September 11, 2017.
Avast reported that the MariaDB database on the command-and-control server logged an InnoDB write failure on September 10, 2017 after the server ran out of disk space, corrupting stored victim data.
Morphisec said it identified and prevented malicious CCleaner.exe installations at customer sites on August 20 and 21, 2017, making it an early detector of the compromise.
The malicious CCleaner 5.33.6162 build was released on August 15, 2017, beginning the supply-chain distribution of the backdoored software. CCleaner Cloud version 1.07 was also affected.
Avast said data gathering on the attackers' server began on August 11, 2017 in preparation for releasing the compromised CCleaner executable.
Avast's later investigation said the first CCleaner build containing the malicious payload appeared on August 2, 2017, indicating attacker access to the build process before the broader release window described elsewhere.
Avast later found that the command-and-control server used in the CCleaner operation had been installed on July 31, 2017.
Avast acquired Piriform, the maker of CCleaner, in July 2017; one source specifies the acquisition date as July 18, 2017.
A September 25 update cited by WIRED said Avast confirmed that 40 computers received the secondary malware payload across 11 named companies, including Samsung, Sony, Asus, Intel, VMware, O2, Singtel, Gauselmann, Dyn, Chunghwa, and Fujitsu.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourceblog.avast.com
Open sourceblog.avast.com
Open sourceblog.avast.com
Open sourcewired.com
Open sourceblog.talosintelligence.com
Open sourceblog.avast.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised ASUS's **Live Update** infrastructure and used legitimate ASUS digital certificates to distribute a trojanized software update to Windows users in a supply-chain attack dubbed **ShadowHammer**. The malicious update was reportedly delivered between June and November 2018 and reached a large number of systems, with Kaspersky identifying more than 57,000 affected customers and Symantec seeing at least 13,000 among its own users; reporting indicated the broader victim count may have reached into the hundreds of thousands. Researchers said the operation was highly selective despite its broad distribution: the backdoored updater checked hashed **MAC addresses** against an embedded target list and only contacted a command-and-control domain to retrieve a second-stage payload on roughly 600 intended machines. SentinelOne and other researchers described the campaign as a tailored, stealthy supply-chain intrusion linked to activity associated with **ShadowPad** and the **CCleaner** compromise, while criticism mounted over ASUS's response, including allegations that the company was slow to acknowledge the breach and revoke compromised certificates.
Jun 29, 2026
A broad software supply-chain campaign attributed to **TeamPCP** compromised trusted developer and security tools, beginning with a poisoned **Trivy GitHub Action** after attackers allegedly stole a personal access token via a misconfigured `pull_request_target` workflow. Researchers said malicious commits were pushed to most Trivy action tags, allowing the attackers to steal CI/CD secrets, cloud credentials, SSH keys, Kubernetes configuration, and other sensitive data from downstream users. The campaign then spread through stolen credentials to additional projects, including **Checkmarx KICS**, **LiteLLM** versions `1.82.7` and `1.82.8` on PyPI, the **Telnyx SDK**, and later **Bitwarden CLI**, with malware exfiltrating data to attacker-controlled infrastructure such as `checkmarx[.]zone` and `models[.]litellm[.]cloud`. Reporting also tied the operation to hundreds of compromised systems and large-scale theft of `.env` files and secrets from cloud, AI, payment, database, and messaging environments. The fallout expanded beyond package poisoning into downstream intrusions and data leaks. **Checkmarx** confirmed that data later leaked by **LAPSUS$** came from its private GitHub repository and said the initial access was likely enabled by credentials exposed in the Trivy-related compromise; researchers also linked the broader campaign to **Bitwarden** through shared malware and command-and-control patterns. Malicious KICS Docker images, GitHub Actions, and editor extensions were reported to steal credentials and scan results, while Bitwarden’s CI/CD workflow was allegedly abused to expose an npm token and publish a tainted `@bitwarden/cli` release. Security researchers and vendors warned that the campaign shows how attackers are increasingly targeting open-source maintainers and security tooling as high-leverage entry points, with reported ties to extortion and ransomware groups including **LAPSUS$** and **Vect** raising the risk that stolen access will be resold or used for follow-on attacks.
Jul 4, 2026
Researchers have tied **ShadowPad**, a modular malware platform sold privately rather than shared openly, to multiple high-profile espionage operations and supply-chain compromises. Analysis indicates the backdoor emerged as a successor to `PlugX` and has been used by several China-linked activity clusters, including subgroups associated with **APT41** as well as actors previously linked to **Axiom**. Investigators say ShadowPad’s architecture allows its developer to restrict plugin access per customer, helping multiple espionage teams reuse the same malware while complicating attribution and lowering development costs for operators. ShadowPad has surfaced in several notable intrusions, including the **CCleaner** compromise, where a trojanized installer reached about **2.27 million** users but a second-stage payload was delivered to only **40** selected systems; investigators also found ShadowPad on Piriform machines with decrypted logs showing **keylogging** activity. It was also linked to **Operation ShadowHammer**, in which attackers trojanized **ASUS Live Update** binaries that retained valid ASUSTeK signatures and selectively activated only on devices whose network-adapter `MAC` addresses matched hardcoded target lists before contacting `asushotfix[.]com` for a second stage. Reporting also connects related activity to compromises involving **NetSarang**, corporate networks, and Asian gaming-sector targets, reinforcing ShadowPad’s role as a recurring tool in selective, supply-chain-enabled Chinese espionage.
Aug 15, 2026