Supply Chain Attack Through CCleaner
summary
Avast’s CCleaner update carries a backdoor in the main executable v5.33.6162 modified executable that infects millions of users but the attacker delivers a second-stage payload to a very small set of targets (Avast logs show 23 compromised machines at eight firms; threat actor queries suggest ~40 targeted organizations including Microsoft, VMware and Cisco). Integer’s analysis uses a code genome database of billions of binary fragments and finds ~15% shared code, a unique base64 impl and identical API-string obfuscation, supporting attribution to APT17/Operation Aurora.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:09ABOUT ME
- 1:56TOPICS OF DICUSSION
- 2:36WHAT IS A SUPPLY CHAIN ATTACK?
- 3:56RESULT OF SUPPLY CHAIN ATTACK
- 5:29CASE STUDY: CCLEANER SUPPLY CHAIN ATTACK
- 6:56CCLEANER ATTACKER OVERVIEW
- 9:16TARGETS AND EFFECTIVENESS
- 12:13CODE REUSE DETECTION
- 15:11WHAT DO WE KNOW ABOUT APT 177
- 16:29STAGE 1 - CODE REUSE
- 19:37CODE EXAMPLES
- 20:46STAGE 2 -CODE REUSE
- 22:36KEY TAKEAWAYS
related talks
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads
51mThe Enemy Within: Modern Supply Chain Attacks
19mOperation PZCHAO
42mXZ Backdoor: Navigating The Complexities Of Supply Chain Attacks Detected By Accident
26mnx Compromise - AI as an Attack Vector
52mLessons Learned from the Summer of Supply Chain Attacks
32mHow Things Are Going For APT41 In 2024
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits