Excerpt
Published in coordination with Google Threat Intelligence Group and Mandiant. Their report on the wider UNC7017 campaign is available here.
Detection: On 28 May 2026, ManageEngine EDR recorded AOMEI Backupper installing Radmin, a commercial remote-administration tool. The same execution chain appeared on a second, unrelated customer endpoint in another country within the same window.
Delivery: Within the 232-file AOMEI promotional bundle, upgrade-now.html programmatically triggered a sibling executable through AOMEI’s own in-application content flow.
Integrity gap: Neither configuration file is…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by manageengine.com on manageengine.com.
Mentioned in the excerpt
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
