{"id":2127,"date":"2026-10-18T07:19:13","date_gmt":"2026-10-18T00:19:13","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-unc7017-tan-cong-chuoi-cung-ung-keo-dai-vai-phut\/"},"modified":"2026-10-18T07:19:13","modified_gmt":"2026-10-18T00:19:13","slug":"unc7017-profile-supply-chain-attack-lasting-only-minutes","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-unc7017-tan-cong-chuoi-cung-ung-keo-dai-vai-phut\/","title":{"rendered":"UNC7017 Profile: The Supply Chain Attack That Lasted Only Minutes"},"content":{"rendered":"

UNC7017 turned AOMEI software's legitimate update mechanism into a malware delivery channel during windows lasting only five to ten minutes. This on-and-off tactic meant most post-incident checks saw clean files, while computers that updated at the right moment could retain a long-lived backdoor.<\/p>\n

\"Diagram
AOMEI's update and notification mechanism was abused to redirect users to a malicious package. Image: Google Threat Intelligence Group\/Mandiant<\/figcaption><\/figure>\n

Who Is UNC7017?<\/h2>\n

UNC7017 is the temporary name Google Threat Intelligence Group (GTIG) uses to track an activity cluster not yet attributed to a specific country or organization. The group was identified during a joint GTIG, Mandiant, and ManageEngine Threat Analysis Lab investigation into AOMEI Technology's update infrastructure.<\/p>\n

Available data indicates the campaign ran from late April through July 2026. Observed victims included IT services, telecommunications, higher education, and related organizations in at least ten countries. Because the malicious server served any device polling during an attack window, the actual scope may be broader.<\/p>\n

Intrusion Through Five-to-Ten-Minute Windows<\/h2>\n

Instead of planting a permanently malicious update, UNC7017 modified configurations on AOMEI's origin servers only briefly. GTIG confirmed three windows: ten minutes on May 28, six minutes on July 16, and five minutes on July 20, 2026. After each burst, the configurations were restored to legitimate versions.<\/p>\n

This method reduced the likelihood of automated scanners catching the tampering and made post-alert URL checks prone to the false conclusion that the system was safe. Endpoints polling before or after the window received clean content; those polling at the right time were instructed to download a weaponized ZIP package.<\/p>\n

Abusing the Update and Notification Logic Itself<\/h2>\n

AOMEI Backupper s\u1eed d\u1ee5ng t\u1ec7p down_html.ini<\/code> \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh phi\u00ean b\u1ea3n, m\u00e3 MD5 v\u00e0 \u0111\u1ecba ch\u1ec9 t\u1ea3i g\u00f3i c\u1eadp nh\u1eadt. UNC7017 thay URL b\u1eb1ng h\u1ea1 t\u1ea7ng do m\u00ecnh ki\u1ec3m so\u00e1t, t\u0103ng s\u1ed1 phi\u00ean b\u1ea3n nh\u1ecf v\u00e0 c\u1eadp nh\u1eadt MD5 \u0111\u1ec3 \u1ee9ng d\u1ee5ng ch\u1ea5p nh\u1eadn g\u00f3i gi\u1ea3.<\/p>\n

Nh\u00f3m \u0111\u1ed3ng th\u1eddi s\u1eeda Notifycfg.ini<\/code>, ch\u00e8n h\u00e0ng ch\u1ee5c ngh\u00ecn ph\u1ea7n c\u1ea5u h\u00ecnh gi\u1ea3 nh\u1eb1m v\u01b0\u1ee3t ki\u1ec3m tra phi\u00ean b\u1ea3n v\u00e0 bu\u1ed9c d\u1ecbch v\u1ee5 th\u00f4ng b\u00e1o ch\u1ea1y m\u00e3 \u0111\u1ed9c. \u0110\u00e2y kh\u00f4ng ph\u1ea3i khai th\u00e1c m\u1ed9t l\u1ed7i b\u1ed9 nh\u1edb trong \u1ee9ng d\u1ee5ng; k\u1ebb t\u1ea5n c\u00f4ng chi\u1ebfm l\u1ee3i th\u1ebf t\u1eeb quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n l\u1edbp ph\u00e2n ph\u1ed1i v\u00e0 s\u1ef1 tin c\u1eady m\u1eb7c \u0111\u1ecbnh d\u00e0nh cho tr\u00ecnh c\u1eadp nh\u1eadt.<\/p>\n

From CROSSROAD to SHINYROAD<\/h2>\n

The first stage used the CROSSROAD downloader to validate the environment, clean artifacts, and retrieve the next component. The malware checked whether its path contained AOMEI, determined geolocation through IP reflection services, and could stop its primary execution path when the device was in China.<\/p>\n

CROSSROAD created a scheduled task for persistence and then deployed SHINYROAD in the user's Radmin directory. The execution chain abused a legitimate signed Radmin binary to load an unsigned DLL through search-order hijacking. Compiled Python payloads were decrypted and run in an embedded PocketPy interpreter, reducing library artifacts on disk.<\/p>\n

A Backdoor Hidden Behind Legitimate Administration Tools<\/h2>\n

SHINYROAD supports an interactive shell, encrypted command-and-control communications, and traffic chaffing to hinder detection. Placing malicious components beside legitimate Radmin software means a review based only on executable signatures can miss the accompanying DLL.<\/p>\n

\u1ede giai \u0111o\u1ea1n sau, UNC7017 c\u00f2n \u0111\u01b0a Adaptix C2 xu\u1ed1ng m\u00e1y n\u1ea1n nh\u00e2n d\u01b0\u1edbi t\u00ean gi\u1ed1ng c\u00f4ng c\u1ee5 qu\u1ea3ng b\u00e1 ho\u1eb7c qu\u00e9t t\u00e0i li\u1ec7u c\u1ee7a Nitro PDF. T\u00e1c v\u1ee5 NitroRuntime<\/code> ch\u1ea1y t\u1ec7p \u1ea9n b\u1eb1ng PowerShell, c\u00f2n DLL ADAPTAGENT \u0111\u01b0\u1ee3c sideload \u0111\u1ec3 ph\u00e1t t\u00edn hi\u1ec7u \u0111\u1ecbnh k\u1ef3 t\u1edbi m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n.<\/p>\n

Coercing Devices to Send NTLM Credentials<\/h2>\n

On July 20, the group replaced a legitimate promotional banner with an invisible 1\u00d71 pixel window pointing to a WebDAV resource over a UNC path. When the application tried to load the content, Windows could automatically send a NetNTLMv2 authentication response to the attacker's server without any visible user action.<\/p>\n

K\u1ef9 thu\u1eadt n\u00e0y t\u1ea1o th\u00eam \u0111\u01b0\u1eddng \u0111\u00e1nh c\u1eafp th\u00f4ng tin x\u00e1c th\u1ef1c ngay c\u1ea3 khi payload th\u1ef1c thi b\u1ecb ch\u1eb7n. N\u00f3 c\u0169ng cho th\u1ea5y th\u00e0nh ph\u1ea7n marketing v\u00e0 tr\u00ecnh hi\u1ec3n th\u1ecb n\u1ed9i dung t\u1eeb xa c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng nghi\u00eam tr\u1ecdng n\u1ebfu cho ph\u00e9p giao th\u1ee9c file:\/\/<\/code> ho\u1eb7c UNC ngo\u00e0i Internet.<\/p>\n

Why Restoring the Server Is Not Enough<\/h2>\n

AOMEI said it took corrective action after Mandiant notified it in July. However, restoring clean server configurations does not remove malware from systems that already downloaded the fake package. Scheduled tasks, backdoors, and post-exploitation tools can continue operating independently.<\/p>\n

Investigators therefore need to review telemetry across the entire April\u2013July 2026 period instead of checking only the current URL state. Proxy logs, EDR data, and configuration copies in AOMEI temporary directories are more valuable than a live request made hours after an alert.<\/p>\n

Priority Hunting Indicators<\/h2>\n
    \n
  • T\u00e1c v\u1ee5 theo l\u1ecbch RadminComponentRuntime<\/code> or NitroRuntime<\/code> kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t.<\/li>\n
  • C\u00e1c t\u1ec7p BlkScrDl.dll<\/code>, RuntimeComponent.dll<\/code>, metadata.dat<\/code> or Eztwain4.dll<\/code> trong th\u01b0 m\u1ee5c Radmin\/Nitro Pro c\u1ee7a ng\u01b0\u1eddi d\u00f9ng.<\/li>\n
  • T\u1ec7p upgrade-now.exe<\/code>, upgrade-now.zip<\/code> ho\u1eb7c ti\u1ebfn tr\u00ecnh l\u1ea1 xu\u1ea5t ph\u00e1t t\u1eeb th\u01b0 m\u1ee5c Tmphtml<\/code>\/html<\/code> c\u1ee7a AOMEI.<\/li>\n
  • K\u1ebft n\u1ed1i t\u1edbi c\u00e1c mi\u1ec1n storage-data.com<\/code>, promotion.storage-data.com<\/code>, aomei.storage-data.com<\/code> ho\u1eb7c User-Agent Anyviewer-loader\/1.0<\/code>.<\/li>\n
  • Outbound SMB or WebDAV traffic, especially from background update or notification processes.<\/li>\n<\/ul>\n

    Supply Chain Defense Lessons<\/h2>\n

    Developers should digitally sign not only installers but also remote configuration files, verify Authenticode before execution, restrict download domains, and block dangerous URIs in content-rendering components. HTTPS and an MD5 value stored in a configuration file that can be changed at the same time do not provide end-to-end integrity.<\/p>\n

    For SOC teams, alerts about unsigned child processes spawned by a legitimate updater must remain high priority even when the current URL returns clean content. UNC7017 shows that a supply chain attack does not need to leave a permanently malicious update behind: a few minutes of control at the right time can create access lasting for months.<\/p>\n

    VNCyberS<\/strong> compiled from Google Threat Intelligence Group and Mandiant<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    UNC7017 \u0111\u00e3 bi\u1ebfn c\u01a1 ch\u1ebf c\u1eadp nh\u1eadt h\u1ee3p ph\u00e1p c\u1ee7a ph\u1ea7n m\u1ec1m AOMEI th\u00e0nh k\u00eanh ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c trong nh\u1eefng kho\u1ea3ng th\u1eddi gian ch\u1ec9 t\u1eeb 5 \u0111\u1ebfn 10 ph\u00fat. Chi\u1ebfn thu\u1eadt \u201cb\u1eadt r\u1ed3i t\u1eaft\u201d n\u00e0y khi\u1ebfn ph\u1ea7n l\u1edbn l\u1ea7n ki\u1ec3m tra sau s\u1ef1 c\u1ed1 ch\u1ec9 nh\u00ecn th\u1ea5y t\u1ec7p s\u1ea1ch, trong khi c\u00e1c m\u00e1y t\u00ednh […]<\/p>\n","protected":false},"author":2,"featured_media":2126,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[973,974,976,86,176,975,87,972],"class_list":["post-2127","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-aomei","tag-crossroad","tag-google-threat-intelligence","tag-malware","tag-mandiant","tag-shinyroad","tag-tan-cong-chuoi-cung-ung","tag-unc7017"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2127"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2127\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2126"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}