APT17__2017__Aurora_Operation_CCleaner.pdf

This report analyzes a supply-chain compromise in Avast's CCleaner (v5.33.6162) where a backdoor was injected into the legitimate build, linking the implanted component to APT17/Operation Aurora via unique shared code (base64 implementation) and assembly-level matches; the analysis details the loader, anti-analysis checks, C2 contact (216.126.225.148) and runtime behavior, and highlights attribution evidence and community/vendor findings.