Talos recently published a technical analysis of a backdoor which was included with version 5.33 of the CCleaner application. At least 20 victim machines were served specialized secondary payloads. The attacker used a symlink to redirect all normal traffic to the ‘x.php’ file, which contains the malicious PHP script. The server implemented a series of checks to determine whether to proceed with standard operations or redirect to the legitimate Piriform web site. It also specifies the database configuration to use, as well as the filename and directory location to use for the.x86DllName.”]
Source: https://blog.talosintelligence.com/2017/09/ccleaner-c2-concern.html