{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/unc7017/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["UNC7017"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AOMEI Backupper","AnyViewer"],"_cs_severities":["high"],"_cs_tags":["supply-chain","backdoor","remote-access","credential-harvesting"],"_cs_type":"threat","_cs_vendors":["AOMEI Technology"],"content_html":"\u003cp\u003eBetween May and July 2026, the threat actor UNC7017 conducted a sophisticated, short-lived supply chain attack against AOMEI Technology. By gaining unauthorized access to AOMEI update servers, the attackers repeatedly replaced configuration files (down_html.ini and Notifycfg.ini) for short windows of 5-10 minutes. Because the AOMEI Backupper software lacks cryptographic verification for these update files, compromised clients automatically downloaded and executed malicious payloads delivered via the update flow.\u003c/p\u003e\n\u003cp\u003eThe campaign avoided detection by reverting the server-side configuration to legitimate files immediately after the malicious windows, ensuring that triage attempts checking the vendor's site would appear clean. The attack targets included organizations in IT services, telecommunications, and education across 11 countries. The campaign notably utilized both binary implants and a non-executable WebDAV-based NTLM credential harvesting technique. AOMEI has reported taking corrective server-side actions, but no software update has been released to address the lack of cryptographic verification in the update mechanism itself.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains unauthorized write access to AOMEI update server infrastructure.\u003c/li\u003e\n\u003cli\u003eAttacker replaces 'down_html.ini' and 'Notifycfg.ini' with malicious variants for a 5-10 minute window.\u003c/li\u003e\n\u003cli\u003eTarget AOMEI Backupper process checks for updates over HTTPS and downloads the attacker-specified malicious package.\u003c/li\u003e\n\u003cli\u003e'Notifycfg.ini' triggers the execution of the downloaded malicious package with the privileges of the AOMEI service.\u003c/li\u003e\n\u003cli\u003eThe 'CROSSROAD' downloader executes, creates a scheduled task for persistence, and removes itself from the disk.\u003c/li\u003e\n\u003cli\u003eThe scheduled task invokes a signed, legitimate Radmin binary paired with a malicious DLL that loads the 'SHINYROAD' backdoor.\u003c/li\u003e\n\u003cli\u003e'SHINYROAD' establishes C2 communication; attackers may subsequently push the Adaptix framework disguised as Nitro PDF software.\u003c/li\u003e\n\u003cli\u003eIn some instances, the attacker triggers an invisible WebDAV pop-up to force NTLMv2 authentication credential leakage.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe campaign successfully compromised systems across 11 countries, including Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. Successfully infected machines grant the actor remote shell access, persistence, and potential credential harvesting capabilities. As the implant runs with the privileges of the AOMEI service, it can facilitate system-wide software installation and code execution, representing a significant compromise of the host environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHunt for unauthorized scheduled tasks including 'RadminComponentRuntime' or 'NitroRuntime' created between May and July 2026.\u003c/li\u003e\n\u003cli\u003eBlock outbound connections to the malicious infrastructure (storage-data[.]com, promotion.storage-data[.]com, aomei.storage-data[.]com) and the associated IP addresses (8.210.84.56, 8.218.65.184, 47.239.60.117).\u003c/li\u003e\n\u003cli\u003eBlock outbound SMB (TCP 445) and WebDAV traffic from internal hosts to unauthorized external destinations to prevent NTLM credential relay.\u003c/li\u003e\n\u003cli\u003eInspect file system logs for unsigned executables or suspicious binaries originating from AOMEI's local application data folders.\u003c/li\u003e\n\u003cli\u003eDeploy Sigma rules to detect the creation of unusual scheduled tasks from AOMEI-related processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:27:42Z","date_published":"2026-10-16T18:27:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aomei-update-tampering/","summary":"UNC7017 performed an opportunistic supply chain attack by intermittently compromising AOMEI update servers to deliver backdoors, credential-harvesting pop-ups, and remote administration tools to Windows users.","title":"UNC7017 Supply Chain Attack via AOMEI Backupper Update Infrastructure","url":"https://feed.craftedsignal.io/briefs/2026-10-aomei-update-tampering/"}],"language":"en","title":"CraftedSignal Threat Feed - UNC7017","version":"https://jsonfeed.org/version/1.1"}