Researchers from security firm Intezer speculate that the attack was powered by nation-state actor, likely the Chinese APT17 group. The hackers first compromised in July a CCleaner server, then exploited it to deliver a backdoored version of the popular software. It has been estimated that between August 15 and September 12, over 2.27 million users downloaded the tainted version. The attack targeted at least 20 major international technology firms with a second-stage malware. The first payload has many similarities with the code used by the Axiom group.”]
Source: https://securityaffairs.co/wordpress/63801/apt/ccleaner-apt17-hackers.html