Hidden Backdoor in CCleaner Security App Has Infected 2.3 Million People

Hidden Backdoor in CCleaner Security App Has Infected 2.3 Million People

Hackers have hidden a backdoor in a security application called CCleaner. So far it has 2 billion downloads and has infected 2.3 million people and counting.

Security researchers have discovered cyber criminals have installed a backdoor in a security application for PCs. Users of the Avast-owned CCleaners for Windows have been advised to update their software immediately.

Researchers at Cisco Talos discovered the threat on Sept. 13 after CCleaner 5.33 caused their systems to flag malicious activity. The company warned that the hack could be comparable to the NotPetya ransomware outbreak, which spread after a Ukrainian accounting app was infected.

The hacked application allows for download of further malware, such as ransomware or keyloggers, and there are fears that virtually billions could be impacted. The security app has 2 billion downloads and claims to be getting five million extra a week, making the threat even more severe.

The backdoor installed in the application would send encrypted information about the infected computer - the name of the computer, installed software and running processes - back to the hacker's server. The hackers also used what is known as a domain generation algorithm (DGA) whenever the criminal's server went down, the DGA could create new domains to receive and send stolen data. Researchers have noted that the use of a DGA shows that these hackers are very sophisticated.

Further investigation found that the CCleaner download server was hosting the backdoored app as far back as Sept. 11 and the affected version had been released on August 15. Which means for weeks the malware was spreading inside a supposedly-legitimate security software.

On Sept. 12, CCleaner released an untained version of the software, version 5.34.

Featured

  • An Inside Look From Napco at ISC West

    Get a look into the excitement at ISC West 2025 from Napco. Hear from some of their top-tech executives live from the show floor. Read Now

    • Industry Events
    • ISC West
  • Upping the Ante

    I am not a betting man in terms of cards, dice, blackjack or that wheel with the black marble racing around the circumference of a spinning wheel, but I would bet on the success of ISC West this year. Read Now

    • Industry Events
    • ISC West
  • It's Show Time

    I am one of those people that likes to see things get bigger and better. As advertised, ISC West is going to be bigger (more exhibitors) and better (more attendees). It’s show time in Las Vegas. Read Now

    • Industry Events
    • ISC West
  • SIA Releases New Report on Operational Security Technology

    The Security Industry Association (SIA) has released an impactful new resource – Operational Security Technology: Principles, Challenges and Achieving Mission-Critical Outcomes Leveraging OST. Read Now

New Products

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection.