--- title: "Backdoor Found in CCleaner: Reinforces the Need for Better Data Protection" description: A backdoor found in CCleaner shows cybercriminals will continue to invent new ways to access user data – like putting malware into official software builds. canonical_url: https://www.acronis.com/en/blog/posts/backdoor-found-ccleaner-reinforces-need-better-data-protection/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Backdoor Found in CCleaner: Reinforces the Need for Better Data Protection Users of CCleaner for Windows, a maintenance and file clean-up tool developed by Avast Piriform, are being told to update their software immediately, since it’s been discovered that hackers had installed a backdoor in the official application that would allow additional malware to be added to the infected system. The ability of cybercriminals to access user systems by adding malware into official software builds of trusted vendors is a major red flag. Protecting your data just got even more critical, so here’s what you need to know. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: Peter Hale](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png)](https://www.acronis.com/en/blog/authors/peter-hale/ "Peter Hale") [Peter Hale](https://www.acronis.com/en/blog/authors/peter-hale/) 2 min read Last updated 27 November 2019 Users of CCleaner for Windows, a maintenance and file clean-up tool developed by Avast Piriform, are being told to update their software immediately, since it’s been discovered that hackers had installed a backdoor in the official application that would allow additional malware to be added to the infected system. On September 13, researchers at Cisco Talos found that downloads of CCleaner 5.33 and CCleaner Cloud 1.07.3191 contained more than just the official free versions – a domain generation algorithm (DGA) and hardcoded Command and Control function was incorporated into the software. That means hackers somehow gained access to the official development process and implanted malware designed to steal data from the product’s two million users. While Avast Piriform acted quickly to fix the problem once the malware was detected, Cisco Talos’ investigation found the compromised version of CCleaner was released on August 15 – so the malware was spreading inside trusted, legitimate security software for weeks undetected. "This is a prime example of the extent that attackers are willing to go through in their attempt to distribute malware to organizations and individuals around the world," said Cisco Talos in its blog about the attack. “By exploiting the trust relationship between software vendors and the users of their software, attackers can benefit from users' inherent trust in the files and web servers used to distribute updates." The ability and tenacity of hackers to develop new attack vectors is definitely concerning. After all, you should be able to rely on updates from a trusted utility vendor like Avast. Updates to those kind of tools are vital for your system’s well-being, but if their automatic updates can be compromised, how are you supposed to keep your system safe? ## Reliable backup defeats malware Every new malware incident illustrates that having reliable backup is the only way to absolutely counter these attacks. Regardless of the kind of malware that is introduced to your system – from keyloggers to ransomware to wipers – only regular, reliable backup gives you the ability to revert to a clean, safe version of your data. Cybercriminals recognize that backup is a threat to their plans, so they are increasingly using ransomware to target the backup files that provide users a safe harbor. That means users must evolve their defenses at the same time. ## Protecting your backup Some traditional methods of protecting your backup are still critical. Keeping a three copies of your backup, using two types of storage media, and storing one of those off-site is still the gold standard. The [3-2-1 Rule of Backup](https://www.acronis.com/en-us/resource-center/resource/17/) guarantees you’ll have a safe, secure way to restore your system. But an important new step is to complement signature-based anti-malware – which looks for computer code that’s known to be malicious – with technology that detects infections based on suspicious activity and process behavior. Behavior-based solutions are the only ones capable of intercepting the next generation of malware. The need to defend backup files is why we developed [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/), our artificial intelligence-based anti-ransomware technology, which is incorporated in both our consumer and business backup products. Since launching earlier this year, our technology has stopped more than 15,000 ransomware attacks for 10,000 customers, including consumers using [Acronis True Image](https://www.acronis.com/en-us/personal/computer-backup/) and businesses that have deployed [Acronis Backup 12.5](https://www.acronis.com/en-us/business/backup/). **Final Thought** In covering the incident, _PCWorld_’s Michael Simon ended by observing, “Ransomware is becoming a troubling trend, and if hackers are able to infect update servers they can spread malware to as many machines as possible.” Thankfully generating and securing reliable backup with [Acronis](https://www.acronis.com/en-us/) [can protect both businesses and families](http://www.acronis.com/en-us/) from losing data or being locked out of their system – regardless of how creative cybercriminals become. [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 3: Peter Hale](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png) Peter Hale [Previous post](https://www.acronis.com/en/blog/posts/celebrating-3-years-acronis-international-hq-singapore/) [Celebrating 3 years of Acronis International HQ in Singapore](https://www.acronis.com/en/blog/posts/celebrating-3-years-acronis-international-hq-singapore/) [Next post](https://www.acronis.com/en/blog/posts/acronis-files-advanced-80-perfect-file-sync-and-share-solution-your-business/) [Acronis Files Advanced 8.0: A Perfect File Sync and Share Solution for Your Business](https://www.acronis.com/en/blog/posts/acronis-files-advanced-80-perfect-file-sync-and-share-solution-your-business/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 6: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read