> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # UNC7017 hijacks AOMEI update servers to distribute malware via supply chain - URL: https://f4n6.co.uk/security-feed/unc7017-hijacks-aomei-update-servers-to-distribute-malware-via-supply-chain/ - Published: 2026-10-20T21:19:47.000Z - Updated: 2026-10-20T21:19:47.000Z - Author: Jeff Davies - Tags: #security-feed, UNC7017 ## 1\. Executive summary Between April and July 2026, an unknown cluster tracked as UNC7017 repeatedly altered configuration files on AOMEI's update and notification servers, redirecting the Windows backup tool AOMEI Backupper to download and execute a backdoor during tampering windows of five to ten minutes. Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab confirmed three windows (May 28, July 16, July 20) and state that additional windows probably occurred outside their visibility. Confirmed victims are IT services, telecommunications and higher education organisations in almost a dozen countries, including Portugal, Spain, Switzerland and Türkiye; no CVE is associated with this item and no CISA KEV entry applies, because the attackers abused an unauthenticated delivery channel rather than exploiting a software flaw. The risk to EMEA financial services is credential exposure and persistent remote access on any host that ran Backupper 8.3.0 or later and polled for updates during a window, and AOMEI has not yet identified or notified the affected customers. UNC7017 has no MITRE ATT&CK profile, so the attribution is unconfirmed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The compromise sits in the ICT third-party chain: AOMEI's own update and notification servers delivered the payload, and AOMEI has not identified which customers were infected. | Third-party risk management must cover the vendor's update and content-delivery channel, not only the backup product. Contractual and monitoring arrangements with AOMEI need review, and the vendor's detection tool and disclosure timeline should be requested in writing. | | DORA Art. 19 | Confirmed compromises span IT services, telecommunications and higher education across almost a dozen countries, and the true victim count is probably higher. | Any EMEA client with a confirmed infection has a major ICT-related incident to report to its competent authority once the Art. 18 classification is done. The reporting clock starts from detection, not from AOMEI's notification, which has not happened. | | NIS2 Art. 21(2)(d) | The malicious content arrived through the vendor-hosted delivery path over HTTPS from AOMEI-owned hostnames, not through a flaw in the client. | Supply chain security measures must include integrity verification of vendor-delivered content and monitoring of vendor update channels, because the client's own controls did not stop the delivery. | ## 3\. Technical analysis & attack chain The campaign did not exploit a vulnerability in AOMEI Backupper. ManageEngine states plainly that "nothing in AOMEI Backupper was exploited." The attackers abused the promotional pop-up channel, which runs background services polling AOMEI's servers for content and includes two configuration paths that deliver content to a directory and execute it. Neither configuration file is cryptographically authenticated by the client, and the checksum used to validate the archive is declared inside the same unauthenticated file that names it. That design is what made the hijack possible: whoever can write the configuration can also supply the matching checksum. Confirmed steps: 1. The attackers altered `down_html.ini` on AOMEI's update server. This file tells Backupper which package to download and which checksum to expect. They pointed it at attacker-controlled locations and supplied a matching checksum, so the malicious ZIP passed validation. 2. They altered `Notifycfg.ini`, which controls pop-up notifications, to open a page in an invisible window. That page launched a dropper Google calls CROSSROAD. 3. CROSSROAD performed system validation, cleanup and payload staging. It stopped if the machine was located in China, if it could not determine the machine's location, or if certain security products were present. 4. On systems that passed those checks, CROSSROAD installed a genuine copy of Radmin Server alongside a malicious DLL loaded through it, which established a reverse TCP connection to the attackers' command-and-control server. It also installed the SHINYROAD modular backdoor, created a scheduled task to launch the backdoor every three hours, and then deleted itself from disk. 5. In the July 20 window, the attackers also replaced a legitimate banner with a 1x1 pixel window assigned maximum execution priority, forcing the AOMEI client to request a remote resource over WebDAV. This sent the logged-in user's NetNTLMv2 authentication hash to an attacker-controlled server. No malicious code needs to run for this to work, so hosts where the dropper was blocked may still have leaked credentials. 6. In July, after SHINYROAD deployment, UNC7017 dropped AdaptAgent, part of the Adaptix C2 post-exploitation framework. The three directly confirmed windows are May 28, July 16 and July 20, each lasting five to ten minutes. The activity was observed on Backupper version 8.3.0 and later. The same system also serves AnyViewer customers; Google's report documents targeting of AnyViewer, but AOMEI says its monitoring found "only AOMEI Backupper exhibited anomalies" with "no abnormal activity" in AnyViewer. Treat AnyViewer exposure as unresolved rather than cleared. The dropper deletes itself after staging the next payload and creating persistence, so the absence of `upgrade-now.exe` does not mean a host is clean. AOMEI's server-side fixes do not clean already-infected machines. Google and ManageEngine both say organisations must hunt across the whole April to July period. Confidence caveats. The technical chain rests on the coordinated reports from Google Threat Intelligence Group, Mandiant and ManageEngine, which corroborate each other on the core mechanism and the three windows. The victim-country list and the AnyViewer scope are single-sourced to Google and disputed in part by AOMEI. The China-exclusion logic is reported by ManageEngine; the researchers caution it does not establish where the attackers are based and could be intended to avoid local law enforcement, avoid particular security firms, or mislead investigators. UNC7017's origin and motivation remain unknown, and no MITRE ATT&CK profile exists for the cluster, so attribution is unconfirmed. ## 4\. Mitigation & containment P1 within 24 hours - Inventory every host running AOMEI Backupper 8.3.0 or later, including Windows Server builds. For each, pull the application's update and notification logs and check for activity on May 28, July 16 and July 20, then widen to the full April to July period. - Hunt for `upgrade-now.exe` and `upgrade-now.zip`, the `RadminComponentRuntime.html` file and `Tmphtml` folders. An unsigned `upgrade-now.exe` is a positive indicator. Its absence proves nothing, because the dropper self-deletes. - Check for a scheduled task that launches a backdoor every three hours. Remove any such task and preserve the binary before deletion. - Check for Radmin Server installed on hosts where IT did not deploy it, and for a Radmin-associated DLL making an outbound reverse TCP connection. Block Radmin traffic at the perimeter where it has no business use. - Block or alert on `promotion.storage-data.com`, `aomei.storage-data.com`, `storage-data.com`, `8.210.84.56`, `47.239.60.117` and `8.218.65.184` at proxy, DNS and firewall. Log whether these were blocked or allowed; an allowed connection is an exposure event. - Treat any host that checked for updates during a window as credential-exposed. Because the WebDAV coercion leaks NetNTLMv2 without running code, reset passwords for logged-in users on those hosts and review authentication logs for NTLM relay or pass-the-hash activity. - Isolate any host with a confirmed backdoor. Do not attempt manual cleanup; rebuild from known-good media. P2 within 72 hours - Run AOMEI's free detection tool across all Backupper installations, then update Backupper to the current build. The detection tool is a starting point, not a clean bill of health. - Disable or restrict the promotional pop-up and notification channel at the endpoint where policy allows, so the client stops polling the vendor content path. This removes the delivery vector for hosts that cannot be patched immediately. - Add EDR coverage for the Adaptix C2 framework and AdaptAgent, and for SHINYROAD. Where EDR blocked the dropper, confirm the WebDAV hash leak did not occur. - Request in writing from AOMEI: the exact tampering windows, the server-side fix applied, and confirmation of whether AnyViewer customers were affected. AOMEI has not yet identified or notified infected customers, so the client cannot rely on vendor notification. P3 within 7 days - Review third-party contracts with AOMEI and any reseller for breach notification, update-channel integrity and audit rights, mapped to DORA Art. 28 and Art. 30. - Add integrity verification for vendor-delivered content to the supply chain control set, since the client's own controls did not stop delivery over HTTPS from vendor-owned hostnames. - Where Backupper is not operationally required, remove it. A backup tool that reaches every file and talks to its vendor on a schedule is high-value cover for an operator, as ManageEngine notes. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | --------------------------- | ---------- | ----------------- | | filename | upgrade-now.exe | high | Malwarebytes Labs | | filename | upgrade-now.zip | high | Malwarebytes Labs | | filename | RadminComponentRuntime.html | medium | Malwarebytes Labs | | path | Tmphtml folder | medium | Malwarebytes Labs | | filename | down\_html.ini | high | Help Net Security | | filename | Notifycfg.ini | high | Help Net Security | | domain | promotion.storage-data.com | medium | Malwarebytes Labs | | domain | aomei.storage-data.com | medium | Malwarebytes Labs | | domain | storage-data.com | medium | Malwarebytes Labs | | ipv4 | 8.210.84.56 | medium | Malwarebytes Labs | | ipv4 | 47.239.60.117 | medium | Malwarebytes Labs | | ipv4 | 8.218.65.184 | medium | Malwarebytes Labs | The domain and IP set is single-sourced to Malwarebytes Labs; verify before enforcing blocks. No file hashes are available in the source material. ```iocs filename upgrade-now.exe filename upgrade-now.zip filename RadminComponentRuntime.html path Tmphtml filename down_html.ini filename Notifycfg.ini domain promotion[.]storage-data[.]com domain aomei[.]storage-data[.]com domain storage-data[.]com ipv4 8.210.84[.]56 ipv4 47.239.60[.]117 ipv4 8.218.65[.]184 ``` Behavioural indicators | behaviour | where to observe | confidence | | --------------------------------------------------------------------------------------------------- | ----------------------------------------- | ---------- | | Backupper downloads and executes a ZIP from a non-AOMEI host after a config change | proxy and DNS logs for Backupper process | high | | Unsigned upgrade-now.exe executed from a Tmphtml path | EDR process creation | high | | Radmin Server installed without IT authorisation, with a DLL making a reverse TCP connection | EDR, installed-software inventory | high | | Scheduled task launching a backdoor every three hours | Windows Task Scheduler logs | high | | Outbound WebDAV request from the AOMEI client to an external host, with NetNTLMv2 authentication | proxy, WebDAV server logs, NTLM auth logs | high | | Dropper exits without action on hosts geolocated to China or with certain security products present | EDR process telemetry | medium | ## 6\. Detection ```yara rule UNC7017_AOMEI_CrossRoad_Dropper { meta: author = "Adverse Trace" date = "2026-10-20" reference = "https://www.helpnetsecurity.com/2026/10/20/aomei-backupper-compromised-supply-chain/" description = "Detects the CROSSROAD dropper and AOMEI tampered configuration artefacts" strings: $f1 = "upgrade-now.exe" ascii wide $f2 = "upgrade-now.zip" ascii wide $f3 = "down_html.ini" ascii wide $f4 = "Notifycfg.ini" ascii wide $f5 = "RadminComponentRuntime.html" ascii wide $f6 = "Tmphtml" ascii wide condition: uint16(0) == 0x5A4D and 2 of them } ``` ```yaml title: AOMEI Backupper update channel abuse by UNC7017 id: 7c1e4a2b-unc7017-aomei status: experimental description: Detects Backupper executing a staged upgrade-now.exe from a Tmphtml path and outbound connections to the storage-data infrastructure author: Adverse Trace date: 2026-10-20 references: - https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc logsource: category: process_creation product: windows detection: selection_img: Image|endswith: '\upgrade-now.exe' selection_path: CommandLine|contains: 'Tmphtml' selection_dns: QueryName|endswith: - 'storage-data.com' condition: selection_img or selection_path or selection_dns falsepositives: - Legitimate AOMEI promotional content (verify signature and path) level: high ``` The YARA rule keys on the tampered configuration filenames and the staged dropper name; it will match the dropper and the modified configuration files, not the legitimate AOMEI installer. The Sigma rule covers process creation and DNS query telemetry. Neither rule requires a hash. ## 7\. Sources - Recorded Future News, "AOMEI yet to notify customers after hackers hijacked its software updates", https://therecord.media/aomei-yet-to-notify-customers-hijack-software, 2026-10-20. - Malwarebytes Labs, "AOMEI Backupper update servers hijacked to push malware: Check your PC", https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc, 2026-10. - The Hacker News, "Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor", https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html, 2026-10. - SecurityWeek, "AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign", https://www.securityweek.com/aomei-backupper-compromised-in-short-burst-supply-chain-campaign/, 2026-10. - Help Net Security, "AOMEI Backupper servers hijacked for minutes at a time to push backdoor", https://www.helpnetsecurity.com/2026/10/20/aomei-backupper-compromised-supply-chain/, 2026-10-20. ## 8\. Adverse Trace position Adverse Trace assesses this as a high-impact supply chain compromise with unconfirmed attribution: UNC7017 has no MITRE ATT&CK profile, no CVE is associated, and no CISA KEV entry applies, so severity rests on the confirmed backdoor, the NetNTLMv2 credential leak and the vendor's failure to identify infected customers, not on a scored vulnerability. Client impact is concentrated in two places: hosts that polled for updates during a five to ten minute window and now carry SHINYROAD with three-hourly persistence, and hosts where the dropper was blocked but the WebDAV coercion still leaked NetNTLMv2 hashes. The victim-country list and the AnyViewer scope are single-sourced to Google and partly disputed by AOMEI; verify before relying on either. We will monitor for AOMEI's customer notification and detection-tool updates, track any further GTIG or ManageEngine reporting on additional windows, and reissue this advisory if new tampering windows or IOCs are published. Clients should treat the April to July hunt as mandatory regardless of AOMEI's notification status. --- [Read the original source →](https://therecord.media/aomei-yet-to-notify-customers-hijack-software?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*