Researchers believe the hackers behind the recently disclosed CCleaner malware attack weren't just aiming to infect as many machines as possible — they were after the trade secrets of high-profile tech firms.
On Wednesday, researchers at Cisco's Talos security division said that more than 700,000 machines were infected as part of the CCleaner attack. The hackers used information collected from those machines to identify at least 20 high-profile tech firms — including Cisco itself — which were "served specialized secondary [Stage 2] payloads."
"This would suggest a very focused actor after valuable intellectual property," Cisco researchers wrote.
Besides Cisco, the list of targeted companies includes Google, Intel, Microsoft, Samsung, Sony, HTC, and Linksys, as well as Dell-owned cloud computing software firm VMware, cloud services provider Akamai, British telecom company Vodafone, Taiwanese networking equipment maker D-Link, and Singapore-based mobile network operator Singtel. Talos researchers have reached out to the affected companies and alerted them of a possible compromise.
"These new findings raise our level of concern about these events, as elements of our research point towards a possible unknown, sophisticated actor," the researchers wrote.
During the compromise, the malware would "periodically contact" the attackers' command and control server and "transmit reconnaissance information about infected systems" including IP addresses, online times, hostnames, domain names, process listings, and more, the researchers wrote.
"It's quite likely this information was used by the attackers to determine which machines they should target during the final stages of the campaign," they added. "When combined, this information would be everything an attacker would need to launch a later stage payload that the attacker could verify to be undetectable and stable on a given system."
Updated versions of CCleaner and CCleaner Cloud have been released; users of the former should download CCleaner version 5.34 if they've not already done so, while CCleaner Cloud customers should have already received the update to 1.07.3214.
But Talos researchers said that removing the affected version of CCleaner or updating to the latest version isn't enough to protect Stage 2 victims against this threat. Affected firms should "restore from backups or reimage systems to ensure that they completely remove not only the backdoored version of CCleaner but also any other malware that may be resident on the system."