UNC7017 Used Aomei Update Servers to Deliver Malware in Brief Bursts
Summary
Researchers say UNC7017 tampered with Aomei update and notification configurations from April to July to deliver malware in brief bursts. Aomei secured its servers, but affected endpoints may still need investigation.
Key points
- The campaign targeted Aomei Backupper and AnyViewer update systems, redirecting update requests to attacker-controlled servers without exploiting a software vulnerability.
- Tampering with two unauthenticated configuration files enabled malicious ZIP delivery and local execution; each diversion reportedly lasted five to 10 minutes.
- The ZIP contained Crossroad, which could install legitimate Radmin and use DLL search-order hijacking to load the Shinyroad backdoor.
- Researchers said Crossroad checked host conditions, including geolocation, and in some execution branches stopped its primary payload path when the country code was China.
- Delivery infrastructure shifted from Alibaba Cloud Object Storage to vendor-themed domains such as storage-data[.]com and a public Google Cloud Storage bucket.
- Google Mandiant tracked the actor as UNC7017; Google said it notified affected organizations, and Aomei secured its distribution servers by the end of July.
- Server remediation does not clean already affected endpoints; researchers advised organizations to hunt for compromise associated with campaign activity, including waves on May 28, July 16 and July 20.
Article Details
- Attack Vectors
- Attackers compromised Aomei's update and notification systems and briefly altered Backupper and AnyViewer configuration files to redirect update downloads to malicious ZIP packages and trigger their local execution.
- The malicious configuration changes were active for five to 10 minutes at a time before being replaced with authentic content.
- Crossroad installed legitimate Radmin remote administration software and used a scheduled task to launch its signed executable every three hours; the executable loaded an attacker-controlled DLL through DLL search-order hijacking.
- Shinyroad ran inside a legitimate Windows process and communicated with the attackers' C&C server.
- Crossroad was distributed using Alibaba Cloud Object Storage, vendor-themed domains, and a public Google Cloud Storage bucket; storage-data.com was used for secondary payload retrieval and C2 communications.
- Defensive Notes
- Google said it notified affected organizations, and Aomei took steps to secure its distribution servers.
- Server-side remediation does not clean endpoints that downloaded malicious updates; organizations were advised to proactively hunt for compromise during the May 28, July 16, and July 20 campaign waves.
- The article reports that the affected configuration files were not cryptographically authenticated by clients, and the archive checksum was declared in the same unauthenticated file that identified the archive.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | storage-data[.]com | Vendor-themed domain used to deliver Crossroad secondary payloads and for C2 communications. |
MITRE ATT&CK
T1053.005 · Scheduled TaskCrossroad created a scheduled task to launch the signed Radmin executable every three hours.T1055 · Process InjectionShinyroad ran inside a legitimate Windows process.T1105 · Ingress Tool TransferCrossroad downloaded secondary components, and the malicious ZIP was delivered from attacker-controlled servers.T1195.002 · Compromise Software Supply ChainThe actor compromised Aomei's update and notification systems to deliver malware through Backupper and AnyViewer.T1565.002 · Transmitted Data ManipulationThe actor tampered with server-side update and notification configuration files to redirect downloads and force malware execution.
People
Praveen Kumar DManageEngine researcher who discussed the lack of cryptographic authentication for the configuration files.Tyler McLellanGoogle Mandiant principal threat analyst who described the campaign and Crossroad behavior.Veeramani SomasundaramManageEngine researcher who discussed the lack of cryptographic authentication for the configuration files.Vishal SantharamManageEngine researcher who discussed the lack of cryptographic authentication for the configuration files.
Threat Actors
Malware
CROSSROADThe ZIP archive contains Crossroad, an initial downloader responsible for environment validation and staging secondary components. Crossroad checks for geolocation and whether multiple concurrent instances exist on theSHINYROADThe malicious DLL launches Shinyroad inside a legitimate Windows process, allowing the backdoor to communicate with the attackers' C&C server while disguising its activity as trusted software, McLellan said.
Vendors
Products
AnyViewerupdate and notification systems used by its disaster recovery tool Backupper, and remote access service AnyViewer, and delivered malware in repeated, minutes-long intervals from April to July.AOMEI Backupperhackers compromised Aomei's update and notification systems used by its disaster recovery tool Backupper, and remote access service AnyViewer, and delivered malware in repeated, minutes-long intervals fromRadminon May 28 when Aomei Backupper installed a modified version of commercial remote administration tool Radmin to establish persistent remote access on two unrelated endpoints from different countries in the same
Countries
Industries
Higher Educationpolling the update distribution servers, including those used by IT services, telecommunications, higher education and other sectors in more than 10 countries. The campaign represents a new approach to supply chainIT servicesopportunistically targeted any system polling the update distribution servers, including those used by IT services, telecommunications, higher education and other sectors in more than 10 countries. The campaignTelecommunicationstargeted any system polling the update distribution servers, including those used by IT services, telecommunications, higher education and other sectors in more than 10 countries. The campaign represents a new