Cybersecurity Threat Evolved: Aomei Update Servers Compromised for Malware Distribution
Recent revelations highlight a sophisticated cyber attack that has compromised the update and notification systems of Aomei, a Hong Kong-based software firm specializing in backup and recovery solutions. This unprecedented tactic involved harnessing the company’s update logic to disseminate malware from servers controlled by the attackers. Researchers have cataloged these assaults, which occurred intermittently, spanning from April to July, during brief windows of five to ten minutes — a method that poses significant challenges for detection and forensic analysis.
The Attack’s Nature and Execution
The attackers, identified as UNC7017 by Google, managed to infiltrate Aomei’s systems without exploiting any existing vulnerabilities. Instead, they targeted systems that queried Aomei’s update distribution servers, which are utilized by a diverse range of sectors such as IT services, telecommunications, and higher education across over ten countries. This attack is notable for its innovation, differing from traditional supply chain attacks that often involve direct interference with source code or software build processes.
Tyler McLellan, a principal threat analyst at Google Mandiant, pointed out that this incident marks a significant shift in tactics. He remarked, "This is the first time we have encountered a software supply chain compromise that was implemented with these very short windows, effectively evading traditional point-in-time triage and automated file scanning."
Google has taken steps to inform organizations that fell victim to this breach, and Aomei has reportedly implemented measures to fortify its distribution servers against future attacks. The company serves a staggering 190 million users across 180 countries, with notable clients including major corporations like Amazon, Microsoft, Cisco, and Walmart.
Discovery of Malicious Activity
The malicious activity was initially detected on May 28 by ManageEngine, a threat analysis lab, when it identified a modified version of the Radmin commercial remote administration tool being deployed by Aomei Backupper on two distinct endpoints situated in different countries. The research showed that the attackers had altered two key configuration files involved in Aomei’s update process: down_html.ini and Notifycfg.ini.
The down_html.ini file is crucial because it directs the software on where to download the update packages and provides essential versioning and integrity-checking data. Meanwhile, the Notifycfg.ini file governs the notification service, dictating message displays and local program executions.
According to McLellan, "The threat actor modified the update settings file on the update server to redirect the software to download a malicious ZIP package from attacker-controlled servers." Additionally, they manipulated the notification settings file, ensuring that the system executed the downloaded malware locally.
Crucially, neither of the configuration files was authenticated cryptographically by the client, leaving them vulnerable to tampering. This permitted attackers to intermittently reroute legitimate update requests to malicious downloads for brief periods before reverting to safe content.
The Payload and Its Mechanism
The malicious payload consists of a downloader named Crossroad that undertakes various crucial tasks such as environment validation and staging secondary components. Notably, Crossroad checks the geographical location of the host system and evaluates whether multiple instances of the software are operating concurrently. If any instance is detected in China, the loader aborts its operations to evade post-attack scrutiny.
Designed with an ephemeral characteristic, Crossroad is programmed to delete itself if its file path lacks specific identifiers. However, this self-deletion mechanism does not hinder its operational capabilities, allowing it to concurrently execute while covering its tracks.
Following its execution, Crossroad initiates the installation of the Radmin software along with additional malicious components. It also schedules tasks to execute a signed Radmin executable every three hours, which in turn loads a malicious dynamic-link library (DLL) through a technique known as DLL search-order hijacking. This method manipulates the search order for DLLs, ensuring that the attackers’ malware is prioritized.
Evolving Delivery Mechanisms
The attackers have exhibited resourcefulness in modifying their infrastructure, transitioning from Alibaba Cloud Object Storage to various themed domains for delivering Crossroad payloads. This shift allowed them to evade enterprise proxy filters that typically block newly registered domains.
Despite Aomei’s remediation efforts by the end of July, endpoints that had previously downloaded the malicious updates remain compromised. The campaign unfolded in three major waves on May 28, July 16, and July 20, while related malware samples had been identifiable since late April. McLellan underscores the importance of proactive measures, urging organizations to diligently search for signs of compromise during these pivotal windows.
Conclusion
The compromised Aomei systems reveal a significant advancement in cyber adversarial tactics, whereby attackers exploit trusted software mechanisms for malicious purposes. This incident not only underscores the pervasive nature of cyber risks in today’s digital landscape but also highlights the need for organizations to adopt vigilant and adaptive security postures to counteract emerging threats.