Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner

A supply-chain backdoor was found in Avast's CCleaner (v5.33.6162) that appears to have been planted in the build process; analysis shows unique base64 implementation and other code overlaps tying the backdoor to APT17/Operation Aurora. The report provides disassembly, loader/PE-in-memory techniques, execution flow, the malicious sample SHA256, a C2 IP (216.126.225.148), and discusses potential wide impact and continued activity by the threat actor.