DEV Community

Anoymask
Anoymask

Posted on

AOMEI Update Infrastructure Compromised: CROSSROAD and SHINYROAD Delivered in 5–10-Minute Tampering Windows

#security #threatintel

1. Basic Information

2. Quick Summary

UNC7017 tampered with AOMEI's update and notification configuration files for only 5 to 10 minutes, causing legitimate clients that connected during those windows to execute malware such as CROSSROAD or SHINYROAD without user interaction, while also triggering NetNTLMv2 authentication via invisible WebDAV references.

3. Attack Flow

Brief Update Infrastructure Tampering and Subsequent Deployment

  1. UNC7017 modified down_html.ini and Notifycfg.ini on AOMEI's origin servers for only 5 to 10 minutes before reverting them to the legitimate configurations.
  2. Legitimate clients that polled the configuration during the tampering window retrieved the attacker's ZIP archive, and the notification mechanism executed the CROSSROAD dropper without user interaction.
  3. CROSSROAD deployed subsequent components to endpoints that passed environmental checks. Depending on the timing and sample, SHINYROAD, Radmin-related components, and Adaptix C2 were observed and persisted via scheduled tasks, though not all of these necessarily ran sequentially on the same endpoint.
  4. As an alternative vector, invisible WebDAV references within the notification configuration triggered NetNTLMv2 authentication attempts from endpoints to the attacker's IP.
Observation Date (2026) Tampering Duration Tampering Target & Key Behavior Notes and Observation Limits
May 28 10 minutes Malicious ZIP distribution and CROSSROAD execution via down_html.ini / Notifycfg.ini replacement Reverted to legitimate configuration afterwards. Some samples stopped due to environmental checks (China check, geolocation failure, presence of specific EDR)
July 16 6 minutes Malware distribution and scheduled task persistence via brief INI configuration tampering Observed SHINYROAD, Radmin-related components, Adaptix C2, etc., depending on timing and sample (does not imply all ran on every endpoint)
July 20 5 minutes NetNTLMv2 authentication triggered to 8.210.84.56 via 1x1 pixel file:// WebDAV reference in Notifycfg.ini Credentials sent externally in environments permitting outbound WebDAV/NTLM traffic

4. Attacker Position and Prerequisites

  • The attacker can modify configuration files on AOMEI's distribution servers and targets client endpoints that trust legitimate HTTPS update channels.

5. Visibility for Victims and Administrators

Victim Side

  • Suspicious process execution or remote access may begin after checking for updates, without any user interaction or warning screens.

Administrator Side

  • Appears as upgrade-now.zip or upgrade-now.exe under Tmphtml/html, scheduled tasks NitroRuntime or RadminComponentRuntime, malicious DLLs under Nitro Pro or Radmin directories, and outbound WebDAV traffic.

6. Success and Failure Conditions

Success Conditions

  • Endpoints poll AOMEI's configuration files during the 5-to-10-minute tampering window.
  • The legitimate update and notification process successfully retrieves, extracts, and executes the malicious archive. Deployment of subsequent payloads is also subject to sample-specific environmental checks passing.
  • Outbound WebDAV/NTLM traffic to external IPs must be permitted for authentication triggering via WebDAV to succeed.

Failure Conditions and Defensive Branches

  • Remediation actions on AOMEI's servers stop future unauthorized distribution, but do not automatically remove malware from already-infected endpoints or invalidate NTLM credentials that have been exposed.
  • Blocking outbound SMB/WebDAV traffic, application allowlisting, and detecting scheduled task registration or DLL sideloading can disrupt or detect each stage.

7. What Happens Upon Success

  • Remote command execution and subsequent payload deployment via CROSSROAD or SHINYROAD.
  • Persistent remote access via SHINYROAD or Adaptix C2. Note that while the ManageEngine Threat Analysis Lab (METAL) investigation confirmed the installation of Radmin Server, there was no evidence that Radmin Server was actually running, and remote access relied on outbound C2 traffic from a separate implant.
  • Exposure of NetNTLMv2 credentials and the associated risk of NTLM relay or offline analysis (cracking).

8. Observable Logs

These are investigation candidates. Availability depends on products, privileges, and log retention settings; the absence of records does not prove an absence of compromise.

  • Email: Inference: No intrusions originating from email have been confirmed.
  • Proxy/SWG/DNS: Verify communication records from the AOMEI update process to storage-data.com, Alibaba OSS, Google Cloud Storage, and 8.210.84[.]56.
  • Endpoint/EDR: Confirm execution of upgrade-now.exe under Backupper.exe or ABNotify.exe, hidden PowerShell execution, DLL sideloading, and the creation of NitroRuntime and RadminComponentRuntime.
  • Identity/IdP: Check for signs of authentication anomalies or relay attempts after NetNTLMv2 credentials are sent to external WebDAV servers.
  • SaaS/Cloud: Inference: Because cloud storage URLs were abused to host payloads, do not allow communication based solely on the provider name; verify object paths and parent processes of communication sources.
  • Network: Verify User-Agent Anyviewer-loader/1.0, outbound TCP/445 and WebDAV traffic, and connections to known malicious domains and IP addresses.

9. Scope of Success Confirmation

Subsequent Compromise Confirmed

  • Scope: Endpoints observed by GTIG/Mandiant and METAL. These observations do not cover endpoints that polled outside the tampering windows or establish the global extent of compromise.
  • Basis: Public Information: GTIG/Mandiant and METAL observed CROSSROAD, SHINYROAD, Radmin-related components, and Adaptix C2 across the campaign. However, this does not mean all components were verified running on the same endpoint, and Radmin Server in cases investigated by METAL was confirmed installed only.

Evaluation Criteria for Your Organization

  • Separate contact, execution, information acquisition, and subsequent compromise; do not assume unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start from unknown executable launches under AOMEI update processes, communications to known malicious domains/IPs, and the presence of specified scheduled tasks.
  • Initial Verification: Confirm AOMEI product type, version, installation path, usage between April and July 2026, and alert occurrence timestamps.
  • Endpoint/Server Investigation: Preserve Tmphtml/html, Radmin and Nitro Pro folders under LocalAppData, scheduled tasks, registry data, and memory.
  • Authentication/Cloud Investigation: Verify destinations of NTLM authentication, subsequent use of the same credentials, and potential credential exposure in clouds or APIs.
  • Subsequent Actions: Expand the investigation scope for C2 traffic, remote administration tools, lateral movement, and additional payloads.
  • Containment: Isolate affected endpoints, block outbound WebDAV/SMB traffic and known IOCs, recover from trusted clean media, and rotate associated credentials.
  • Decision Categories: Categorize step-by-step into configuration file polling only, initial execution, backdoor establishment, credential leakage, and subsequent compromise.

11. Defense and Detection Ideas

  • Single Event: Detect events where AOMEI-related processes execute unknown EXEs from Tmphtml/html or reference external file:// WebDAV paths.
  • Temporal Correlation: Correlate the sequence of AOMEI configuration retrieval -> ZIP download -> upgrade-now.exe execution -> scheduled task creation -> DLL sideloading and C2 traffic within a short timeframe.
  • Threat Hunting: Hunt for NitroRuntime, RadminComponentRuntime, specified mutexes/shared memory, and unsigned DLLs placed in the same folders as legitimate binaries.
  • Log Limitations: Because configurations on distribution servers are reverted to normal within 5 to 10 minutes, URL content or reputation at the time of investigation cannot rule out past malicious responses.
  • Priority Mitigations: Prioritize endpoint cache preservation, restriction of outbound NTLM authentication, monitoring of child processes spawned by update processes, and retroactive searches for known IOCs.

12. Facts / Inference / Hypothesis

Facts

  • GTIG and Mandiant confirmed brief configuration tampering against AOMEI's update distribution infrastructure between April and July 2026.
  • Confirmed tampering durations were 10 minutes on May 28, 6 minutes on July 16, and 5 minutes on July 20, with configurations reverted to legitimate states afterwards in all instances.
  • Attackers replaced URLs, versions, and MD5 hashes in down_html.ini, using instructions in Notifycfg.ini to deploy and execute malicious ZIPs.
  • SHINYROAD, Radmin-related components, and Adaptix C2 were observed across the campaign. CROSSROAD gated follow-on payload execution on environmental checks; samples analyzed by METAL halted subsequent processing if the environment was identified as being in China, if geolocation checks failed, or if specific EDRs were present. Additionally, confirmation that Radmin Server was installed is distinct from evidence that it was running.
  • The Notifycfg.ini file on July 20 used a 1x1 pixel file:// WebDAV reference to trigger NetNTLMv2 authentication to 8.210.84.56.
  • AOMEI stated it implemented remediation measures to protect distribution servers, but separate actions are required to remove malware from already-infected endpoints.

Inference

  • Even if legitimate distribution URLs appear clean at the time of investigation, failing to preserve cached INI files retrieved by endpoints at the alert timestamp and proxy communication records risks misjudging actual compromises as false positives.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Open Questions & Additional Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain high Tampered with AOMEI update and notification configurations to distribute malware to legitimate clients. Definition
T1187 Forced Authentication high Triggered NetNTLMv2 authentication via invisible WebDAV references. Definition
T1053.005 Scheduled Task/Job: Scheduled Task high Established persistence via scheduled task registration of NitroRuntime and RadminComponentRuntime. Definition
T1574.001 Hijack Execution Flow: DLL high Placed malicious DLLs side-by-side with legitimate Radmin and Nitro-related binaries for loading. Mapped to current DLL technique definition. Definition

14. Open Questions & Additional Investigation

  • The possibility of short-term tampering instances beyond the three observed, the initial intrusion vector into AOMEI origin servers, and the global number of victim organizations remain unknown.

15. Impact on SOCs and Organizations

In environments with endpoints running AOMEI products, organizations should not rely solely on confirming the current safety of distribution servers; instead, they must retroactively check endpoint caches, proxy logs, scheduled tasks, and outbound NTLM traffic between April and July 2026.

16. Audience-Specific Summaries

  • For SOCs: Correlate INI files cached at alert timestamps, child processes of AOMEI update processes, and known scheduled tasks, domains, and WebDAV traffic.
  • For Administrators: Update AOMEI products to the latest versions and restrict outbound SMB/WebDAV traffic. If compromise indicators are present, do not assume safety based solely on the normalization of distribution sources; isolate endpoints and re-investigate.
  • For Users: If instructed to isolate devices or re-authenticate on endpoints running AOMEI products, promptly disconnect from the network and contact administrators.

Top comments (0)