Résumé
In September 2017, Cisco Talos revealed that CCleaner, a hugely popular Windows cleanup tool from Piriform (newly acquired by Avast), had been shipping a backdoor. Attackers had compromised Piriform's build environment and inserted malicious code into the official, validly code-signed installer, so version 5.33 distributed through Piriform's own channels carried the malware to about 2.27 million users for roughly a month before anyone noticed. The first stage merely profiled machines, but it was a sniper rather than a shotgun: from the millions of installs it served a second stage to only a few dozen selected computers at companies like Google, Microsoft, Cisco, Intel, and Samsung, and a still deeper espionage tool (the ShadowPad backdoor) was later found planted on Piriform's own internal machines. The attack is linked to the China-nexus group tracked as APT17 / Axiom. It is the lesson that a trusted update channel and a valid signature are not the same as trustworthy code, and that build pipelines are prime targets.
How it happened
The attackers did not break CCleaner; they broke the machine that builds it. They first got in through remote-access software (TeamViewer) on a Piriform developer's workstation around March 2017, then reached the build environment and inserted their backdoor into the pipeline itself. So when CCleaner version 5.33 (the 32-bit build) and CCleaner Cloud were compiled and released, the malware was baked in, then signed with Piriform's own valid, Symantec-issued code-signing certificate and pushed out through Piriform's official download servers. To every security check and every user, it looked exactly like a legitimate release, because in every way that a signature can prove, it was one. About 2.27 million people installed it between mid-August and mid-September (the attackers' command server logged around 700,000 of them).
But those millions were not the target; they were the funnel. The first-stage code only collected basic fingerprints of each machine (its name, installed software, and network address) and phoned home. From those fingerprints the operators hand-picked a small set of machines (Talos confirmed at least 20 were served a second stage) at major technology firms (Google, Microsoft, Cisco, Intel, Samsung, Sony, VMware, HTC, Akamai, D-Link, and others), and delivered a second-stage downloader (GeeSetup) that installed further trojanised, partly fileless backdoors. A deeper, third-stage tool, the ShadowPad backdoor, the calling card of a Chinese state-linked group, was separately discovered on four of Piriform's own internal machines, complete with an active keylogger. The attribution to APT17 / Axiom rested on code overlaps and was suggestive rather than definitive. It was a supply-chain attack run as precision espionage: poison a consumer utility used by millions, then reach into a few dozen specific corporations.
The damage
For most of the 2.27 million users, the practical harm was limited to the profiling stage. The real damage was the targeted intrusion into a curated list of technology companies, the kind of access that fuels long-term espionage and further supply-chain compromise. The lasting significance is the proof of concept: a nation-state had used a trusted vendor's build pipeline as a delivery mechanism, and a valid digital signature had certified malware as safe. Three years later the same playbook returned at far greater scale in the SolarWinds compromise.
Why CCleaner still matters
CCleaner is an early, clean example of the attack that now defines supply-chain security: compromise the build, not the product. Every assumption it broke is one defenders still lean on. A signature proves where code came from, not that it is safe. An official download channel is only as trustworthy as the pipeline behind it. And the sniper pattern, mass distribution as a funnel to a tiny, targeted payload, is now standard tradecraft. The defences are to treat the build and CI environment as top-tier infrastructure (least privilege, MFA, isolation), protect signing keys in hardware, demand reproducible and verified builds with provenance and an SBOM so what ships matches what was built, and monitor the integrity of build hosts and release artifacts, not just the source code.
Comment le corriger
- Pull the trojanized version, ship a clean rebuild from a known-good pipeline, and tell users to update.
- Rebuild build servers from trusted media and rotate code-signing keys and all CI/CD credentials.
- Hunt downstream for the second-stage payload and persistence, especially among high-value targets.
- Review everything that touched the build system between compromise and discovery to scope the blast radius.
Comment l’éviter
- Harden and isolate the build and CI environment as a top-tier asset: least privilege, MFA, and tight network controls.
- Protect signing keys in HSMs, and require reproducible, verified builds so injected code is detectable.
- Generate and verify artifact provenance and SBOMs so what ships matches what was built from source.
- Monitor the integrity of build hosts and release artifacts, not just the source repository.
- Remember that a valid signature proves origin, not safety; downstream defenders should still watch update behavior.
Références
- https://blog.talosintelligence.com/avast-distributes-malware/
- https://blog.talosintelligence.com/ccleaner-c2-concern/
- https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities
- https://thehackernews.com/2018/04/ccleaner-malware-attack.html
Vulnérabilités liées
Tout Supply chain →- HIGHSC-NOTEPADPP-CHRYSALIS-2025
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.
- HIGHSC-ESCAN-RELOAD-2026
On or around January 20, 2026, attackers who had broken into a regional update server for eScan, the antivirus product made by India's MicroWorld Technologies, pushed a trojanized Reload.exe through the legitimate update channel during a window of roughly two hours. The security software itself became the delivery vehicle for malware. The malicious binary carried eScan's code-signing identity, but its signature was actually invalid; it ran anyway because the updater trusted the channel rather than rigorously validating the signature. Once on a host, the malware rewrote the Windows HOSTS file to cut eScan off from its own update servers, blinded script scanning, and reached out to takedown-resistant command-and-control hosted on blockchain naming systems. Morphisec disclosed the campaign, with Kaspersky and Darktrace corroborating it independently.
- CRITICALNPM-QIX-CHALK-DEBUG-2025
On 8 September 2025, the largest npm supply-chain attack ever by sheer reach hit foundational packages, chalk, debug, ansi-styles, strip-ansi, and 14 more, that together are downloaded over 2 billion times a week. The cause was a single phishing email. A respected maintainer was tricked by a fake "your npm 2FA is expiring" message into handing over his account, and the attackers published poisoned versions of his ultra-popular libraries. The payload was a crypto clipper: browser code that silently swapped any cryptocurrency address a user was sending to with the attacker's. Automated scanners flagged the poisoned versions within minutes and they were pulled within about two hours, and the actual theft came to roughly a thousand dollars, the one piece of good news in an attack that sat, briefly, under nearly the entire JavaScript ecosystem.
- CRITICALSC-KASEYA-VSA-2021
On 2 July 2021, the Friday before the US holiday weekend, the REvil ransomware gang exploited a chain of zero-day flaws in Kaseya VSA, starting with CVE-2021-30116 (an unauthenticated credential leak), in a remote-monitoring-and-management tool used by managed service providers. By abusing VSA's trusted software-deployment mechanism, REvil pushed its encryptor through roughly 50 to 60 MSPs down to about 1,500 of their downstream business customers in one cascading supply-chain hit, including Sweden's Coop grocery chain, which closed about 800 stores. REvil demanded $70 million for a universal decryptor; a decryptor key was ultimately obtained and distributed without payment. It is the lesson that the management tools with the most reach are the highest-value targets and need the strongest controls.
- CRITICALCVE-2019-15107
Disclosed in August 2019, CVE-2019-15107 was an unauthenticated remote code execution backdoor in Webmin, a widely deployed web-based system administration tool that runs with root privileges. The backdoor existed in the password_change.cgi feature: a Perl qx() statement passed the unsanitized old (and in some versions expired) parameter from the password-change request straight to a shell, letting an unauthenticated attacker run arbitrary commands as root, with version 1.890 exploitable in its default configuration and 1.900 through 1.920 exploitable when password expiry was enabled. Critically, the malicious code was never present in Webmin's GitHub source, which remained clean; it was inserted directly into the build infrastructure that produced the official SourceForge release packages, so users who installed signed official builds were backdoored while anyone auditing the public Git source saw nothing wrong. Webmin later confirmed the code was added on its build server on two separate occasions, in April 2018 producing the 1.890 release and again in July 2018 reintroducing it into 1.900 through 1.920, meaning backdoored builds were distributed for over a year. The project released 1.930 on August 17, 2019 to remove the backdoor.
- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)