UNC7017 Targets AOMEI Technology in Software Supply Chain Attack

Summary

UNC7017 carried out a sophisticated software supply chain campaign targeting AOMEI Technology update infrastructure. The threat actor used brief configuration-tampering windows to redirect update requests toward malicious servers, helping evade traditional point-in-time scanning. The campaign delivered a multi-stage payload chain that included the CROSSROAD downloader and SHINYROAD backdoor.

Investigation

The investigation was conducted jointly by Mandiant Google Threat Intelligence Group (GTIG) and ManageEngine Threat Analysis Lab (METAL). Researchers detected the campaign through EDR telemetry and confirmed that the adversary relied on ephemeral tampering windows lasting only five to ten minutes. Analysis also showed an infrastructure shift from cloud providers to dedicated vendor-themed domains and legitimate cloud storage.

Mitigation

Vendors should enforce end-to-end cryptographic signature verification for all downloaded executables and configuration files. Organizations should implement strict destination pinning for update clients to prevent redirection toward unauthorized domains. Restricting URI schemes within in-app handlers can also help prevent WebDAV-based NTLM credential coercion attacks.

Response

Security teams should conduct retrospective endpoint and network hunts covering the April through July 2026 timeframe. Prioritize monitoring for unsigned child processes launched by legitimate update runners and signs of unauthorized network redirection. Analysts should inspect locally cached endpoint configuration files instead of relying solely on live checks of vendor-hosted URLs.

Simulation Execution

• Attack Narrative & Commands: An adversary has successfully deployed a CROSSROAD downloader onto a workstation via a supply chain compromise (T1195.002). To prevent multiple instances of the backdoor from interfering with each other or causing system instability, the malware attempts to create a specific Mutex. The attacker’s goal is to establish a persistent backdoor (T1547) for long-term command and control (C2) and data exfiltration. The simulation will execute a PowerShell script that mimics this behavior by creating the exact global and local mutex strings identified in the detection rule.

• Regression Test Script:

    # CROSSROAD/SHINYROAD Mutex Simulation Script
    # This script simulates the creation of the specific mutexes targeted by the detection rule.
  
    Write-Host "[*] Starting Mutex Simulation..." -ForegroundColor Cyan
  
    # 1. Simulate Global Mutex (CROSSROAD)
    try {
        $globalMutexName = "GlobalF9E6E3C0-E11A-4F85-9944-AF4AD6E05883"
        Write-Host "[!] Attempting to create Global Mutex: $globalMutexName" -ForegroundColor Yellow
        $globalMutex = New-Object System.Threading.Mutex($true, $globalMutexName)
        Write-Host "[+] Global Mutex created successfully." -ForegroundColor Green
    } catch {
        Write-Error "[X] Failed to create Global Mutex: $($_.Exception.Message)"
    }
  
    # 2. Simulate Local Mutex (SHINYROAD)
    try {
        $localMutexName = "Local963d3c60-d406-4ad6-aa1e-dc8e45061ccf"
        Write-Host "[!] Attempting to create Local Mutex: $localMutexName" -ForegroundColor Yellow
        $localMutex = New-Object System.Threading.Mutex($true, $localMutexName)
        Write-Host "[+] Local Mutex created successfully." -ForegroundColor Green
    } catch {
        Write-Error "[X] Failed to create Local Mutex: $($_.Exception.Message)"
    }
  
    Write-Host "[*] Mutexes are held for 30 seconds to ensure telemetry capture..." -ForegroundColor Cyan
    Start-Sleep -Seconds 30
  
    # Cleanup (Manual release is handled by script exit, but explicit is better)
    if ($globalMutex) { $globalMutex.ReleaseMutex() }
    if ($localMutex) { $localMutex.ReleaseMutex() }
  
    Write-Host "[*] Simulation Complete." -ForegroundColor Cyan

• Cleanup Commands:

    # In case the script is interrupted, run this to release the mutexes
    # Note: In PowerShell, if the process dies, the OS usually cleans up the mutex.
    # This is a safety precaution for the simulation runner.
    Write-Host "[*] Running Cleanup..."
    # No specific command needed if process terminates, but we ensure no hanging handles.