cyber.hendryadrian.com
Threat Research · securityweek.com

UNC7017 Used Brief AOMEI Backupper Tampering Windows to Deliver Malware

· Original article ↗

Summary

Researchers report that UNC7017 used brief AOMEI Backupper server-tampering windows to deliver CrossRoad and ShinyRoad malware, compromise organizations across multiple sectors, and steal NetNTLMv2 authentication hashes.

Key points

  • Google Cloud, Mandiant, and ManageEngine researchers reported multiple short-lived tampering windows between April and July; each observed window lasted about five to ten minutes.
  • The actor changed an update settings file to redirect downloads to a malicious archive and altered an automatic notification service to trigger execution.
  • ManageEngine said AOMEI’s promotional-content channel used unauthenticated configuration files to determine what content was delivered and executed.
  • Payloads included CrossRoad, a modified Radmin Server with a malicious DLL, the ShinyRoad backdoor, and AdaptAgent from the Adaptix C2 framework.
  • Researchers observed a separate technique that prompted WebDAV requests and exposed NetNTLMv2 authentication hashes to the attackers.
  • The campaign affected systems that fetched modified packages during the attack windows; researchers also identified compromised higher education, IT services, and telecommunications organizations in multiple countries.
  • ManageEngine notified AOMEI in early June; Google Cloud notified it again in July, and AOMEI said later that month it had taken corrective actions.

Article Details

Attack Vectors
  • UNC7017 tampered with AOMEI Backupper's update settings file to redirect updates to a malicious ZIP archive.
  • The attacker modified the automatic notification service to trigger execution of delivered malware.
  • The campaign abused AOMEI Backupper's promotional content channel, whose unauthenticated configuration files control content delivery and execution.
  • A modified Radmin Server package loaded a malicious DLL that established a reverse TCP connection to the attackers' C2 server.
  • A replaced banner prompted the AOMEI client to request a remote resource via WebDAV, exposing NetNTLMv2 authentication hashes to the attackers.
Defensive Notes
  • AOMEI said in late July that it had taken corrective actions after Google Cloud notified it of the tampering.
  • The article identifies unauthenticated client configuration files and a checksum declared in the same unauthenticated file as weaknesses in the content-delivery channel.

MITRE ATT&CK

T1003.003 · NTDSThe WebDAV request caused the client to send NetNTLMv2 authentication hashes to the attackers.T1053.005 · Scheduled TaskCrossRoad established persistence for the late-stage backdoor; the article does not specify the persistence mechanism.T1071.001 · Web ProtocolsThe malicious DLL established a reverse TCP connection to the attackers' C2 server.T1105 · Ingress Tool TransferModified AOMEI packages delivered CrossRoad and other malicious payloads to affected systems.T1189 · Drive-by CompromiseThe attacker replaced a banner to make the AOMEI client request a remote resource via WebDAV.T1195.002 · Compromise Software Supply ChainUNC7017 tampered with AOMEI Backupper's update configuration and delivered modified software packages through its update and promotional content channels.T1574.002 · DLL Side-LoadingA malicious DLL was loaded through the modified Radmin Server package.

Threat Actors

UNC7017Tracked threat actor responsible for the short-burst AOMEI Backupper supply-chain tampering campaign.

Malware

ADAPTAGENTIn July, after the successful deployment of ShinyRoad, UNC7017 was seen dropping AdaptAgent, which is part of the Adaptix C2 post-exploitation framework.CROSSROADUnlike typical supply chain attacks, this campaign relied on short-lived tampering windows to serve the CrossRoad downloader and the ShinyRoad backdoor.SHINYROADUnlike typical supply chain attacks, this campaign relied on short-lived tampering windows to serve the CrossRoad downloader and the ShinyRoad backdoor.

Vendors

AOMEIBetween April and July, AOMEI Backupper served malware to its users multiple times in short-burst supply chain compromises, security researchers warn.Google Cloudwindow remained active for only five to ten minutes before reverting to authentic versions,” report Google Cloud’s Google Threat Intelligence Group (GTIG) and Mandiant, which investigated the attack alongsideManageEngineCloud’s Google Threat Intelligence Group (GTIG) and Mandiant, which investigated the attack alongside ManageEngine Threat Analysis Lab (METAL).Mandiantreverting to authentic versions,” report Google Cloud’s Google Threat Intelligence Group (GTIG) and Mandiant, which investigated the attack alongside ManageEngine Threat Analysis Lab (METAL).

Products

AOMEI BackupperBetween April and July, AOMEI Backupper served malware to its users multiple times in short-burst supply chain compromises, security researchers warn.Radmin ServerAnalysis of the payload showed the delivery of a legitimate version of the Radmin Server remote administration tool alongside a malicious DLL loaded through it that would establish a reverse TCP connection to the

Tools

Adaptix C&C frameworkThroughout the various stages of the campaign, the threat actor delivered multiple payloads, including the CrossRoad dropper, a modified version of Radmin Server, and the Adaptix C&C framework.WebDAVwindow assigned maximum execution priority that forced the AOMEI client to request a remote resource via WebDAV, thus sending NetNTLMv2 authentication hashes to the attackers.

Countries

AustraliaGoogle Cloud identified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the UnitedBrazilGoogle Cloud identified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United StatesIndiaCloud identified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that havePakistanidentified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have beenPortugalhigher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.SingaporeIT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.South Africaservices, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.Spainand telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.Switzerlandentities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.Türkiyeentities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.United StatesBrazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.

Industries

Higher EducationHowever, throughout the investigation, Google Cloud identified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland,IT servicesHowever, throughout the investigation, Google Cloud identified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland,TelecommunicationsHowever, throughout the investigation, Google Cloud identified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland,

Related Articles