/
← Voltar ao feed
high it services telecommunications education

UNC7017 hijacks AOMEI update infrastructure to deliver CROSSROAD downloader and SHINYROAD backdoor

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 02:15 · coletado há 21 horas

A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate content, so later checks of the vendor's servers could not reproduce the compromise. ManageEngine's Threat Analysis Lab first detected it through endpoint telemetry on May 28, and Google Threat Intelligence Group reported on the malware delivery. Victims were IT services, telecommunications and higher education organizations across eleven countries, including India, Australia, Brazil and the United States. Because exposure was opportunistic, the identified victims probably represent only part of the campaign's reach.

Technical Details

  • Method: The attackers did not modify released binaries. They altered two configuration files, down_html.ini (package location and expected MD5) and Notifycfg.ini (notification content able to trigger local execution). They changed the download destination, incremented version values and supplied a matching checksum. The client did not authenticate these configurations, so the trojanized download passed its checks. No memory corruption exploit or CVE was needed.
  • Exposure windows: Confirmed windows lasted 10 minutes on May 28, 6 minutes on July 16 and 5 minutes on July 20.
  • Execution chain: upgrade-now.zip contained upgrade-now.exe (CROSSROAD). It validated its environment, retrieved further components, created the scheduled task RadminComponentRuntime to launch a Radmin executable every three hours, and then deleted itself. A legitimate, signed Radmin launcher loaded the attacker's BlkScrDl.dll via DLL search-order hijacking. Further components decrypted an embedded PocketPy payload, providing C2 communication, shell execution and delivery of additional code without a Radmin listener.
  • Infrastructure: It moved from Alibaba Cloud storage to vendor-themed domains and Google Cloud Storage. Later activity used Adaptix C2 tooling disguised as Nitro PDF components.
  • Credential exposure: A July 20 modification replaced promotional content with an invisible window referencing an attacker-controlled WebDAV resource. This could coerce NetNTLMv2 authentication material even if the malware chain failed or was blocked.
  • Comparison: The article contrasts the operation with SolarWinds and 3CX, which distributed trojanized components.

Remediation

  • Hunt historical telemetry for executables launched from AOMEI rendering directories, unexpected Radmin DLLs and suspicious scheduled tasks such as RadminComponentRuntime.
  • Server-side remediation does not remove backdoors already installed. A clean configuration retrieved today cannot show what an endpoint downloaded in an earlier window.
  • Consider whether NetNTLMv2 credentials were exposed via the notification channel.
  • AOMEI reported corrective infrastructure action, but ManageEngine had not independently verified containment at publication.

Linha do tempo

  1. gbhackers.com ↗ · pub. 20/10/2026 02:15 · coletado 20/10 03:00 primeiro registro

    UNC7017 hijacks AOMEI update infrastructure to deliver CROSSROAD downloader and SHINYROAD backdoor

    ler a análise desta fonte

    A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate content, so later checks of the vendor's servers could not reproduce the compromise. ManageEngine's Threat Analysis Lab first detected it through endpoint telemetry on May 28, and Google Threat Intelligence Group reported on the malware delivery. Victims were IT services, telecommunications and higher education organizations across eleven countries, including India, Australia, Brazil and the United States. Because exposure was opportunistic, the identified victims probably represent only part of the campaign's reach.

    Technical Details

    • Method: The attackers did not modify released binaries. They altered two configuration files, down_html.ini (package location and expected MD5) and Notifycfg.ini (notification content able to trigger local execution). They changed the download destination, incremented version values and supplied a matching checksum. The client did not authenticate these configurations, so the trojanized download passed its checks. No memory corruption exploit or CVE was needed.
    • Exposure windows: Confirmed windows lasted 10 minutes on May 28, 6 minutes on July 16 and 5 minutes on July 20.
    • Execution chain: upgrade-now.zip contained upgrade-now.exe (CROSSROAD). It validated its environment, retrieved further components, created the scheduled task RadminComponentRuntime to launch a Radmin executable every three hours, and then deleted itself. A legitimate, signed Radmin launcher loaded the attacker's BlkScrDl.dll via DLL search-order hijacking. Further components decrypted an embedded PocketPy payload, providing C2 communication, shell execution and delivery of additional code without a Radmin listener.
    • Infrastructure: It moved from Alibaba Cloud storage to vendor-themed domains and Google Cloud Storage. Later activity used Adaptix C2 tooling disguised as Nitro PDF components.
    • Credential exposure: A July 20 modification replaced promotional content with an invisible window referencing an attacker-controlled WebDAV resource. This could coerce NetNTLMv2 authentication material even if the malware chain failed or was blocked.
    • Comparison: The article contrasts the operation with SolarWinds and 3CX, which distributed trojanized components.

    Remediation

    • Hunt historical telemetry for executables launched from AOMEI rendering directories, unexpected Radmin DLLs and suspicious scheduled tasks such as RadminComponentRuntime.
    • Server-side remediation does not remove backdoors already installed. A clean configuration retrieved today cannot show what an endpoint downloaded in an earlier window.
    • Consider whether NetNTLMv2 credentials were exposed via the notification channel.
    • AOMEI reported corrective infrastructure action, but ManageEngine had not independently verified containment at publication.