AOMEI Patches Critical Flaw CVE-2023-46726 Allowing Backdoor Installation

Key Takeaways

• A sophisticated supply chain attack targeted AOMEI’s software update mechanism, allowing for the delivery of malicious payloads.
• Attackers intermittently altered AOMEI’s server configuration files for brief periods between April and July 2023 to distribute malware.
• The attack did not exploit a software vulnerability but rather manipulated trusted update processes, affecting AOMEI Backupper users.
• Google Cloud’s GTIG and Mandiant identified the threat actors as UNC7017 and the malware as CROSSROAD and SHINYROAD.
• AOMEI has implemented server-side fixes, but affected users must manually remediate installed malware.

Attackers Exploit AOMEI Update System for Backdoor Delivery

A stealthy and intermittent manipulation of AOMEI’s software update infrastructure enabled threat actors to distribute malware through what appeared to be legitimate channels. This sophisticated supply chain attack bypassed typical software vulnerabilities by directly altering server configurations.

Analysts from Google Cloud’s GTIG and Mandiant tracked how attackers repeatedly made transient changes to AOMEI’s update settings. These modifications lasted only a few minutes at a time, occurring between April and July 2023. During these brief windows, any AOMEI Backupper user checking for updates could inadvertently download malicious software instead of the intended legitimate update.

Crucially, this operation did not leverage a flaw in AOMEI’s software or require user interaction like opening a suspicious attachment. Instead, the attackers modified two specific configuration files on AOMEI’s servers. These changes redirected download requests and exploited the program’s notification feature to execute the malicious payload.

While the full scope remains under investigation, affected organizations have been identified across various sectors and countries, including India. The threat intelligence teams dubbed the malware chain CROSSROAD and SHINYROAD, attributing the activity to a group designated UNC7017.

The initial discovery stemmed from telemetry shared by ManageEngine’s Threat Analysis Lab, which observed unusual activity in late May. Following this, AOMEI confirmed to Google that it had implemented corrective measures to secure its distribution servers.

How the Ephemeral Tampering Worked

AOMEI’s update mechanism relies on specific configuration files. The down_html.ini file specifies the package version, checksum, and download location for updates. Concurrently, Notifycfg.ini governs the software’s notification service, including which local programs to initiate.

During the identified tampering periods, attackers modified both these files. This allowed the AOMEI software to accept and launch a malicious ZIP archive. Researchers documented three distinct attack windows: ten minutes on May 28, six minutes on July 16, and five minutes on July 20. After each period, the attackers meticulously reverted the configuration files to their original, legitimate state.

This “ephemeral” nature of the changes made detection particularly challenging. Subsequent investigations of the live update server would only reveal clean files, masking the prior compromise. This approach diverges from typical supply chain attacks involving altered software releases or compromised build systems, echoing incidents like the Notepad++ update breach where attackers similarly targeted trusted software delivery routes.

Despite the brief server-side manipulation, the impact on affected machines was persistent. Any computer that received the malicious instructions during these windows could continue running the harmful files even after AOMEI’s servers were secured.

Further complicating detection, in July, the attackers shifted their delivery method, directing one download through a public Google Cloud Storage bucket. This followed earlier use of Alibaba Cloud storage and domains crafted to mimic legitimate AOMEI infrastructure. This dynamic delivery setup can render simple domain-blocking rules less effective.

Unpacking the Malware Chain

The initial payload, named CROSSROAD, arrived as upgrade-now.exe. This first-stage program conducted system checks, downloaded additional files, established a scheduled task, and then self-deleted. The scheduled task was designed to launch a legitimate Radmin program every three hours. However, a malicious DLL named BlkScrDl.dll, created by the attackers, was placed alongside the Radmin executable and loaded during its startup.

This DLL served as the gateway for SHINYROAD, a backdoor capable of establishing communication with the attackers’ command-and-control systems. Subsequent phases of the attack also involved ADAPTAGENT, a client for the Adaptix command-and-control framework, cleverly disguised as Nitro PDF software.

The tactic of leveraging legitimate administration software and familiar product names makes it significantly harder for defenders to distinguish malicious processes from normal system activity. This strategy has been observed in other recent incidents, such as the DAEMON Tools malware supply-chain compromise, where attackers exploited trusted software channels to reach end-users.

On July 20, attackers introduced an additional risk: credential coercion. They utilized an invisible, one-pixel notification window to compel an AOMEI client to request a remote file via WebDAV. This action could trigger Windows to transmit NetNTLMv2 authentication data to an attacker-controlled server without any visible prompt to the user.

What You Should Do

• Immediately Update: Ensure all AOMEI Backupper installations are updated to the latest available version.
• Endpoint and Network Review: Conduct a thorough review of endpoint and network logs from April to July 2023. Look for unusual child processes initiated by the AOMEI updater, unexpected Radmin or Nitro-related scheduled tasks, and connections to the Indicators of Compromise (IoCs) provided below.
• Examine Configuration Files: Inspect cached AOMEI configuration files (down_html.ini and Notifycfg.ini) and relevant proxy or firewall logs, as the live server may now display legitimate settings.
• Implement Stronger Verification: For software vendors, consider implementing signed configuration files, cryptographic verification of all downloaded updates, and strict domain whitelisting for updater communication.
• Separate Features: Isolate promotional pop-up functionalities from core update execution logic to prevent their misuse for code execution.

Indicators of Compromise (IoCs)

Malicious file hashes

Other file and configuration hashes

Network and host indicators

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.