UNC7017 turned AOMEI software's legitimate update mechanism into a malware delivery channel during windows lasting only five to ten minutes. This on-and-off tactic meant most post-incident checks saw clean files, while computers that updated at the right moment could retain a long-lived backdoor.
Who Is UNC7017?
UNC7017 is the temporary name Google Threat Intelligence Group (GTIG) uses to track an activity cluster not yet attributed to a specific country or organization. The group was identified during a joint GTIG, Mandiant, and ManageEngine Threat Analysis Lab investigation into AOMEI Technology's update infrastructure.
Available data indicates the campaign ran from late April through July 2026. Observed victims included IT services, telecommunications, higher education, and related organizations in at least ten countries. Because the malicious server served any device polling during an attack window, the actual scope may be broader.
Intrusion Through Five-to-Ten-Minute Windows
Instead of planting a permanently malicious update, UNC7017 modified configurations on AOMEI's origin servers only briefly. GTIG confirmed three windows: ten minutes on May 28, six minutes on July 16, and five minutes on July 20, 2026. After each burst, the configurations were restored to legitimate versions.
This method reduced the likelihood of automated scanners catching the tampering and made post-alert URL checks prone to the false conclusion that the system was safe. Endpoints polling before or after the window received clean content; those polling at the right time were instructed to download a weaponized ZIP package.
Abusing the Update and Notification Logic Itself
AOMEI Backupper sử dụng tệp down_html.ini để xác định phiên bản, mã MD5 và địa chỉ tải gói cập nhật. UNC7017 thay URL bằng hạ tầng do mình kiểm soát, tăng số phiên bản nhỏ và cập nhật MD5 để ứng dụng chấp nhận gói giả.
Nhóm đồng thời sửa Notifycfg.ini, chèn hàng chục nghìn phần cấu hình giả nhằm vượt kiểm tra phiên bản và buộc dịch vụ thông báo chạy mã độc. Đây không phải khai thác một lỗi bộ nhớ trong ứng dụng; kẻ tấn công chiếm lợi thế từ quyền điều khiển lớp phân phối và sự tin cậy mặc định dành cho trình cập nhật.
From CROSSROAD to SHINYROAD
The first stage used the CROSSROAD downloader to validate the environment, clean artifacts, and retrieve the next component. The malware checked whether its path contained AOMEI, determined geolocation through IP reflection services, and could stop its primary execution path when the device was in China.
CROSSROAD created a scheduled task for persistence and then deployed SHINYROAD in the user's Radmin directory. The execution chain abused a legitimate signed Radmin binary to load an unsigned DLL through search-order hijacking. Compiled Python payloads were decrypted and run in an embedded PocketPy interpreter, reducing library artifacts on disk.
A Backdoor Hidden Behind Legitimate Administration Tools
SHINYROAD supports an interactive shell, encrypted command-and-control communications, and traffic chaffing to hinder detection. Placing malicious components beside legitimate Radmin software means a review based only on executable signatures can miss the accompanying DLL.
Ở giai đoạn sau, UNC7017 còn đưa Adaptix C2 xuống máy nạn nhân dưới tên giống công cụ quảng bá hoặc quét tài liệu của Nitro PDF. Tác vụ NitroRuntime chạy tệp ẩn bằng PowerShell, còn DLL ADAPTAGENT được sideload để phát tín hiệu định kỳ tới máy chủ điều khiển.
Coercing Devices to Send NTLM Credentials
On July 20, the group replaced a legitimate promotional banner with an invisible 1×1 pixel window pointing to a WebDAV resource over a UNC path. When the application tried to load the content, Windows could automatically send a NetNTLMv2 authentication response to the attacker's server without any visible user action.
Kỹ thuật này tạo thêm đường đánh cắp thông tin xác thực ngay cả khi payload thực thi bị chặn. Nó cũng cho thấy thành phần marketing và trình hiển thị nội dung từ xa có thể trở thành bề mặt tấn công nghiêm trọng nếu cho phép giao thức file:// hoặc UNC ngoài Internet.
Why Restoring the Server Is Not Enough
AOMEI said it took corrective action after Mandiant notified it in July. However, restoring clean server configurations does not remove malware from systems that already downloaded the fake package. Scheduled tasks, backdoors, and post-exploitation tools can continue operating independently.
Investigators therefore need to review telemetry across the entire April–July 2026 period instead of checking only the current URL state. Proxy logs, EDR data, and configuration copies in AOMEI temporary directories are more valuable than a live request made hours after an alert.
Priority Hunting Indicators
- Tác vụ theo lịch
RadminComponentRuntimeorNitroRuntimekhông được phê duyệt. - Các tệp
BlkScrDl.dll,RuntimeComponent.dll,metadata.datorEztwain4.dlltrong thư mục Radmin/Nitro Pro của người dùng. - Tệp
upgrade-now.exe,upgrade-now.ziphoặc tiến trình lạ xuất phát từ thư mụcTmphtml/htmlcủa AOMEI. - Kết nối tới các miền
storage-data.com,promotion.storage-data.com,aomei.storage-data.comhoặc User-AgentAnyviewer-loader/1.0. - Outbound SMB or WebDAV traffic, especially from background update or notification processes.
Supply Chain Defense Lessons
Developers should digitally sign not only installers but also remote configuration files, verify Authenticode before execution, restrict download domains, and block dangerous URIs in content-rendering components. HTTPS and an MD5 value stored in a configuration file that can be changed at the same time do not provide end-to-end integrity.
For SOC teams, alerts about unsigned child processes spawned by a legitimate updater must remain high priority even when the current URL returns clean content. UNC7017 shows that a supply chain attack does not need to leave a permanently malicious update behind: a few minutes of control at the right time can create access lasting for months.
VNCyberS compiled from Google Threat Intelligence Group and Mandiant
Tiếng Việt
English