CCleaner Command and Control Causes Concern
Summary: Cisco Talos analyzed a backdoor bundled with CCleaner version 5.33 and, after obtaining files from the command-and-control server, found a target list that included Cisco and other high-profile technology companies, with at least 20 victim machines served specialized second-stage payloads. The C2 MySQL database, covering September 12th to 16th, showed over 700,000 machines reporting to the server, and the attackers used domain-based filtering to control which infected systems received the Stage 2 payload.
Bottom line: More than 700,000 machines reported to this C2 in four days, yet the attackers chose to deliver the second-stage payload to only 20 - a reminder that mass infection can be the reconnaissance layer for a handful of hand-picked targets, and that removing the backdoored CCleaner version is not the same as removing the intrusion.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026