Background

On 19 October 2026 BleepingComputer reported that a cluster tracked as UNC7017 tampered with two AOMEI Backupper config files between April and July 2026. The files are down_html.ini (where to fetch packages) and Notifycfg.ini (notification content). Each was altered for only minutes, with exposure windows of 5 to 10 minutes on 28 May, 16 July and 20 July, then restored.

ManageEngine’s METAL write-up says no software flaw was exploited and that neither file is cryptographically authenticated; the expected checksum sits in the same file that names the archive. METAL observed the activity on Backupper v8.3.0 and later. AOMEI says it has “taken corrective action”, but both articles say it has not confirmed how the attackers got in, and server-side fixes do not clean endpoints that already received a payload.

What the chain looks like on the endpoint

Per METAL’s EDR telemetry from 28 May:

  1. Signed Backupper.exe extracts an archive to ...\8.3.0\tmphtml\, then moves it to ...\8.3.0\html\.
  2. Signed ABNotify.exe launches the unsigned upgrade-now.exe from html\upgrade-now\. Its product string reads “AOMEI Update Compent”.
  3. The dropper fetches component.zip, runs rsetup64.exe /intsetup (installing Radmin Server) and creates a scheduled task, RadminComponentRuntime, which runs FamItrfc.exe every three hours.
  4. FamItrfc.exe, a genuine signed Radmin binary, side-loads the attacker’s BlkScrDl.dll, which registers RuntimeComponent.dll as a COM server hosted in dllhost.exe. That DLL is the implant (SHINYROAD).

METAL reports Radmin was “staged but never armed”, so there was no listener on the usual port. The control channel is a reverse TCP connection to a single hardcoded address. Separately, GTIG and Mandiant (as relayed by METAL) saw a modified Notifycfg.ini that rendered an invisible window pointing at a WebDAV path, which could leak NetNTLMv2 material with no binary involved.

Detection 1: Sigma, executable launched from the AOMEI html directory

This follows METAL’s behavioural indicator (“any executable launched from ...\<version>\html\”). It is our own rule, not one of METAL’s published Sigma rules.

title: AOMEI ABNotify Launching Executable From html Directory
id: 6f1b8a52-3c0e-4d57-9a41-0b7d2e5c8f13
status: experimental
description: ABNotify.exe or Backupper.exe starting a child process from the AOMEI html or tmphtml staging directories
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ABNotify.exe'
      - '\Backupper.exe'
  selection_child:
    Image|contains:
      - '\html\'
      - '\tmphtml\'
  condition: selection_parent and selection_child
falsepositives:
  - Unknown. Check against a clean AOMEI install in your estate before alerting.
level: high
tags:
  - attack.initial-access
  - attack.t1195.002

Detection 2: KQL, Radmin installer and task persistence

Untested in your environment. Expect noise anywhere Radmin is legitimately deployed; baseline first.

let window = 30d;
union
(DeviceProcessEvents
 | where Timestamp > ago(window)
 | where (FileName =~ "rsetup64.exe" and ProcessCommandLine has "/intsetup")
    or (FileName =~ "schtasks.exe" and ProcessCommandLine has "RadminComponentRuntime")
    or (FileName =~ "FamItrfc.exe" and InitiatingProcessFileName =~ "svchost.exe")
 | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName),
(DeviceImageLoadEvents
 | where Timestamp > ago(window)
 | where FileName =~ "BlkScrDl.dll"
 | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName)
| order by Timestamp desc

The RadminComponentRuntime and BlkScrDl.dll strings are from METAL. They are cheap to rename, so treat a miss as weak evidence. The FamItrfc.exe branch is our assumption about the task host and may need adjusting.

Detection 3: KQL, the C2 address and WebDAV leak

DeviceNetworkEvents
| where Timestamp > ago(120d)
| where (RemoteIP == "8.218.65.184" and RemotePort == 41397)
    or (InitiatingProcessFileName in~ ("ABNotify.exe","Backupper.exe","dllhost.exe")
        and RemotePort in (445, 80) and RemoteIPType == "Public")

The address is from METAL and is a volatile indicator. The second clause is our heuristic for the WebDAV or SMB leak; dllhost.exe will be noisy, so scope it to hosts with AOMEI installed.

Hunting notes

  • METAL recommends hunting April to July 2026 and notes a clean reputation check proves little, since the files had already reverted. It also names AnyViewer as in scope; we have not opened the GTIG report itself.
  • Look for scheduled tasks running every three hours, and COM registrations pointing outside system paths.
  • Block outbound traffic to the C2; METAL says it is the only control channel.
  • METAL says affected environments ran behavioural policies in audit mode, so check what your tooling logged but did not block.

Caveats

Task names, DLL names and the IP come from a single vendor write-up, with partial corroboration from BleepingComputer. Victim counts are not published. As of 22 Oct 2026 we found no public GTIG report in the pages we opened, so attribution to UNC7017 rests on those two secondary sources.