Evidence Aurora Operation Still Active Part 2: More Ties Uncovered Between CCleaner Hack & Chinese Hackers

Intezer's analysis of the CCleaner supply‑chain attack uncovers shared, unique code between the stage‑2 payloads and known Axiom (APT17) samples, provides in‑depth reverse engineering of memory allocation, decompression, registry persistence, service loading of trojanized binaries, and C2 resolution using steganographic tokens on public sites; the report lists multiple IOCs (file hashes and registry keys) and concludes the campaign is likely state‑sponsored.