CCleaner installer shipped multi-stage backdoor

The CCleaner compromise began before the public software update. Avast later found that attackers first entered Piriform's network on March 11, 2017, using TeamViewer on an unattended developer workstation. The single successful sign-in suggested the attacker already had valid credentials. Initial DLL drops failed without admin rights; the third attempt used VBScript and succeeded.

On March 12, the actor moved to a second unattended computer and opened a backdoor through Windows Remote Desktop. In April, a customized ShadowPad payload appeared inside Piriform as mscoree.dll, including on a build server. Avast found no proof that this ShadowPad stage was later delivered to the 40 selected CCleaner victims, but it showed the attacker had months of internal access before the customer-facing payload shipped.

The delivery was the official CCleaner installer. On August 2, attackers replaced the normal build path with a backdoored CCleaner release, and version 5.33.6162 was later downloaded by roughly 2.27 million users. The first stage collected system information and contacted command-and-control, acting less like broad ransomware and more like a filter for targets worth a second step.

The second stage went to 40 computers at major technology and telecommunications companies. Cisco Talos detected the malicious official download on September 13 and notified Avast; with FBI help, Avast took down the command-and-control server within three days. The lasting lesson was bleak and simple: a free utility with a trusted update path can become an intelligence platform if its build chain is owned.