Investigating Ephemeral Supply Chain Tampering

What it is

UNC7017 is a threat cluster tracked by GTIG and Mandiant. Between April and July 2026 it tampered with the update servers of AOMEI Technology (Backupper, AnyViewer) in windows of five to ten minutes, then restored the authentic files. Any client that polled during a window received a malicious update. The ManageEngine Threat Analysis Lab (METAL) first saw it in EDR telemetry in late May. Mandiant notified AOMEI on 17 July 2026, and AOMEI said on 29 July that it had taken corrective action.

Confirmed windows were 28 May (05:40 to 05:50 UTC), 16 July (08:33 to 08:39 UTC) and 20 July (10:35 to 10:40 UTC). GTIG says other windows probably went unseen. Victims were opportunistic, across IT services, telecoms and higher education in 12 countries, including the US, India, Brazil and Spain.

How it works

The client polls two files over HTTPS: down_html.ini (version, MD5, download URL for upgrade-now.zip) and Notifycfg.ini (popups and local commands for ABNotify.exe).

• The actor edited down_html.ini to point at attacker storage, raised the thrid build number and set a matching MD5. The client trusts that MD5 because the file is unauthenticated.
• It injected over 35,000 [dummy_XXXXXX] sections into Notifycfg.ini (16 July). This forced an update regardless of installed version and ran the unpacked upgrade-now.exe (CROSSROAD) from the local html/ directory.
• CROSSROAD checks for "AOMEI" in its own path, queries IP-lookup services and aborts in some branches if the country is CN. It then downloads component.zip from promotion.storage-data.com and registers the scheduled task RadminComponentRuntime, which runs %LOCALAPPDATA%\Radmin\FamItrfc.exe --runtimechk every three hours.
• That signed Radmin binary side-loads BlkScrDl.dll, which registers RuntimeComponent.dll as a COM server. The DLL decrypts a payload (ChaCha20) and runs it in an embedded PocketPy VM (SHINYROAD), with C2 at 8.218.65.184:443.
• CROSSROAD resets thrid to 5 and the URL to the legitimate AOMEI one in the local down_html.ini, then deletes itself (--nitrod).
• On 28 May the actor also dropped a modified Radmin Server (rsetup64.exe /intsetup).
• From mid-July it added Adaptix C2 (ADAPTAGENT, Eztwain4.dll) disguised as Nitro PDF. It uses the task \NitroRuntime and beacons every 2 minutes to 8.210.84.56:6800.
• On 20 July the first download came from a Google Cloud Storage bucket (storage.googleapis.com/aomeiupdate/upgrade-now.zip), which gets past proxies that block newly registered domains.
• The same day, Notifycfg.ini carried a 1x1 popup (Priority=9999) loading file://8.210.84.56/DavWWWRoot/.... This coerces NetNTLMv2 authentication to the actor's IP even if the payload is blocked.

Preconditions / Affected

Any host running AOMEI software that polled the update endpoints during a tampering window. Fixing the server does not remove payloads already installed, so the April to July period needs retrospective hunting.

What to do

• Do not validate alerts by fetching the vendor URL, because it will return clean files. Preserve %PROGRAMFILES(X86)%\AOMEI\*\Tmphtml\ and the proxy and firewall logs for the exact time of the alert.
• Look for the scheduled tasks \RadminComponentRuntime and \NitroRuntime.
• Look for %LOCALAPPDATA%\Radmin\, the mutex Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}, and the shared memory section Local\963d3c60-d406-4ad6-aa1e-dc8e45061ccf.
• Check the registry key \REGISTRY\MACHINE\SYSTEM\Software\Microsoft\TIP\AggregateResults\data for unusual binary blobs.
• Block storage-data.com and its subdomains, 8.210.84.56, 47.239.60.117 and 8.218.65.184.
• Block outbound SMB (TCP 445) and WebDAV to external addresses.
• Search proxy logs for the User-Agent Anyviewer-loader/1.0 and for serv.oss-cn-hongkong.aliyuncs.com.
• Trace the parent process of any alert on updater children, including Nitro-named binaries.
• Use the four YARA rules in the post (CROSSROAD, two SHINYROAD, ADAPTAGENT). Hash tables and the full IOC set are in a GTI Collection for registered users.

Vendors should verify Authenticode signatures on downloads, sign remote config files, pin download destinations, disallow file:// and UNC schemes in popups, and monitor file integrity on origin servers.

Caveats

The visible windows may be a subset of the real ones. Radmin binaries in the bundle are legitimate and signed, so detection must separate them from the hijacking DLL. The post does not say which AOMEI versions are affected. The IOC and hash tables did not come through in the fetched text.