APT17__2017__Aurora_Operation_CCleaner_II.pdf

Intezer's technical analysis of the CCleaner supply‑chain attack (stage 2) documents a trojanized legitimate binary and registry‑stored payloads that are decrypted and executed to establish persistence (service named Spooler or SessionEnv), perform memory‑loaded execution, and connect to C2. The report shows code reuse linking the payloads to the Axiom group (APT17), details techniques including LocalAlloc-based staging, zlib decompression, registry-saved shellcode, steganographic retrieval of C2 (ptoken field XOR decrypted to an IP), and provides hashes and registry keys as IOCs.