Companies need to strongly focus on cybersecurity, and for us this has now become one of the key areas that require attention during an acquisition process.” “First, M&A due diligence has to go beyond just legal and financial matters. Vlcek said that for Avast, there are two key takeaways from the attack. “We don’t have proof that a possible third stage with ShadowPad was distributed via CCleaner to any of the 40 PCs.” Of the 2.27 million downloads of the affected program, a second stage attack-installing ShadowPad-took place on just 40 PCs, all of which belonged to tech and telecommunications companies. “Our investigation revealed that ShadowPad had been previously used in South Korea, and in Russia, where attackers intruded a computer, observing a money transfer,” explained Vlcek. It wasn’t until August 2 that the first contaminated download of CCleaner appeared. The attackers installed the ShadowPad malware on two of the company’s compromised machines, before using its keylogger abilities to gain further access to Piriform’s systems.

“While we don’t know how the attackers got their hands on the credentials, we can only speculate that the threat actors used credentials the Piriform workstation user utilized for another service, which may have been leaked, to access the TeamViewer account,” he said. The person or persons responsible somehow managed to get hold of stolen credentials to log into a TeamViewer remote desktop account on a developer PC. The security firm’s chief technology officer, Ondrej Vlcek, writes that the threat actors accessed Piriform’s network on March 11, 2017, four months before the company was taken over by Avast. We knew there were 2.27 million downloads of the corrupted installation file worldwide, but how the attackers achieved this feat wasn’t specified at the time.

The attack saw hackers modify an updated version of CCleaner to include a malware backdoor. Some details of the incident were unclear at the time, but Avast, which acquired maker Piriform last July, has now revealed more information about what happened.

Back in September last year, it was reported that popular system-cleaning tool CCleaner had been compromised by attackers for over a month.

Teamviewer hacked 2018