CCleaner Malware Carried Mystery Bomb, US Could Be Under Attack

More details about the recent CCleaner malware outbreak have come out and they are terrifying. What was initially thought of as a mild case of infection is now considered an attempt at planting digital bombs, with major US companies as the targets. All in all, the malware hit around 700,000 computers, but only 20 were given a mystery payload.

The malware that came with the digital downloadable version of the antivirus software by Avast was meant to put a backdoor in PCs, Ars Technica reports. While hundreds of thousands of computers became vulnerable to the security risk, it would seem that the person or group responsible for the malware was aiming for some really big fishes.

According to the report published by the Talos Group of Cisco Systems, the hackers infected the computers of large companies with a Trojan. Making the development even worse is the design of the code, which is apparently intended to deliver a third payload and no one knows what this is meant to do.

“The purpose of the trojanized binary is to decode and execute this PE in registry. This PE performs queries to additional C2 servers and executes in-memory PE files. This may complicate detection on some systems since the executable files are never stored directly on the file system,” the report reads.

Avast filed its own report on Thursday, noting that some of the companies that were hit include Sony, Samsung, Microsoft, and even Google’s Gmail. This is just what the analysts know based on the data gathered between September 12th and September 16th. Security experts believe that there could be even more infected units than the several hundred that they estimate.

Analysts also believe that the CCleaner job is part of a series of campaigns being launched by unknown groups and is at least the third attempt in the space of two months. While more data is needed for confirmation, it is beginning to look like the US is under attack and no one is doing anything about it.