It had previously said the second stage of the payload had not been delivered.Īvast adds that it’s continuing to investigate, along with law enforcement, to try to trace the source of the attack. In another new development, Avast said it believes the malware’s second stage payload was indeed delivered - saying server logs indicate it was sent to 20 machines in a total of eight organizations but adding that the actual number is likely to be “at least in the order of hundreds” being as server logs were only captured for three days (vs the several weeks the malware was being distributed). However, rather than speculate, we are focused on working with law enforcement to identify the perpetrators and prevent any damage caused by a second stage payload.” It is possible that this was the result of a State level attack or industrial espionage. So while the malware infected a total of 2.27M PCs between Augand Septemusing CCleaner version as its distribution vehicle - the attackers behind it appear to have been interested in only a specific subset of PC users working for tech firms.Īvast hasn’t published the names of specific companies targeted by the malware for, it says, “privacy reasons” - but says companies in Japan, Taiwan, UK, Germany and the US were targeted.Īsked whether it believes a state-level attacker was responsible for the malware, a spokeswoman for the company told us: “We are not excluding any possibility.
Avast ccleaner malware domain targets update#
In an update on its investigation into the malware, which was revealed to have affected 2.27M users of CCleaner earlier this week, Avast the security company which owns the London-based maker of the software, said the attack was an APT (advanced persistent threat) program that specifically targeted large technology and telecommunications companies.
Avast ccleaner malware domain targets software#
Malware that piggybacked on CCleaner, a popular free software tool for optimizing system performance on PCs, appears to have specifically targeted high profile technology companies and may have been an attempt to harvest IP - perhaps for commercial or state-level espionage.
0 kommentar(er)
