Poisoned Pipeline / Incidents / AS5
CCleaner 5.33 signed ShadowPad backdoor
Windows softwareDeveloper workstationInstaller / update channel
In September 2017 Avast/Piriform shipped CCleaner 5.33.6162 with a
ShadowPad-family backdoor compiled into the legitimate binary and signed
with Piriform’s real code-signing certificate. Avast’s investigation
found the initial access was an unattended developer workstation reached
over TeamViewer; more than 40 machines and the build system were later
infected. Tens of millions of downloads occurred before the poisoned
version was replaced. Talos and Avast published the technical follow-up.
Mapped techniques
- T0153 Compromised developer workstation
- T0113 Compromised user account
- T0137 Weak authentication methods
- T0176 Disable or misconfigure security measures
- T0191 Malicious code in artifacts
- T0208 Compromise code-signing identity
- T0172 Runtime backdoor
- T0201 Customers compromised
supply-chain Piriform / Avast build
Unattended developer workstation accessed via TeamViewer.
TeamViewer credentials reused from another breach.
No MFA on the remote-access path.
Dozens of workstations and the build system were infected without stopping the release.
Custom ShadowPad built into the CCleaner installer.
The backdoored binary was signed with Piriform’s legitimate certificate.
post-supply-chain CCleaner users
ShadowPad allowed further modules and data theft on victim PCs.
Multi-million download blast radius before the version was pulled.