Hackers Hijack AOMEI Update Servers to Secretly Spread Malware
Hackers compromised AOMEI's servers to distribute malware through a built-in promotion feature in its backup software. The attacks affected multiple countries and sectors.
Intelligence analysis by Qwen 2.5 (3B)
Hackers hijacked AOMEI's update servers to secretly spread malware, targeting backup software used by IT services, telecommunications, and education sectors.
Hackers tricked AOMEI's backup software to download bad stuff. They used fake files to hide their trick, but smart people found out and stopped them.
Analysis
UNC7017 Threat Actor
The attackers used a threat actor tracked as UNC7017 to distribute the malware. This actor is known for targeting software update systems to spread malicious payloads.
AOMEI Backupper
The malware was distributed through AOMEI Backupper, a backup software application for Windows. The attackers compromised the update servers used by this software.
Attack Execution Flow
The attackers redirected the software to download a malicious ZIP archive and used the notification mechanism to execute the malware without user interaction. The malicious configuration files were modified to hide the attack.
Malware Components
The attackers deployed two malware components: CROSSROAD, a downloader, and SHINYROAD, a backdoor. SHINYROAD used legitimate Radmin components to establish an outbound connection to the attacker-controlled command-and-control server.
Detection and Response
ManageEngine and Google identified the attacks and confirmed the execution flow. They identified three windows where the malicious configuration file was being sent by AOMEI's servers, and the attackers restored the files to hide the compromise.
Key points
- Hackers compromised AOMEI's update servers
- Used AOMEI Backupper to distribute malware
- Affected multiple countries and sectors
- Two malware components deployed: CROSSROAD and SHINYROAD
- Attackers used legitimate Radmin components to establish a connection
Future software updates will be more secure, thanks to better monitoring and detection systems.
The attack shows that even trusted software can be compromised, so we need to be extra careful about what we download and install.
