/
← Voltar ao feed
high it services telecommunications education

UNC7017 tampers with AOMEI Backupper update servers in short windows to deliver CROSSROAD and SHINYROAD backdoors

1 fonte(s) · 1 atualização(ões) · publicado 16/10/2026 13:43 · coletado há 1 dia

Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed the campaign. GTIG confirmed three windows (May 28, July 16 and July 20) and believes there were more. It identified affected organizations in IT services, telecommunications and higher education across 11 countries, and says the real number is likely higher. AOMEI says it fixed its servers, but that does not clean machines that were already compromised. How the attacker gained write access to AOMEI's servers has not been disclosed.

Technical Details

  • No vulnerability was exploited. Backupper does not cryptographically verify down_html.ini (update package and checksum) or Notifycfg.ini (pop-up content and what to run), and the checksum sits in the same unsigned file. Changing the two text files was enough.
  • The payload ran with the privileges of the AOMEI process. On the machines the lab examined, that was enough for system-wide installation, depending on how the service was running.
  • The CROSSROAD downloader unpacked a bundle into a local Radmin folder, created a scheduled task that runs every three hours, then deleted itself and restored the genuine local update file.
  • The bundle contained a genuine signed Radmin binary, which sideloads an attacker-built DLL that loads the SHINYROAD implant. SHINYROAD provides a remote shell and can fetch and run new code. It uses a single hard-coded C2 address with no fallback.
  • CROSSROAD stops if the host is in China or if it finds certain security agents. On some hosts GTIG later saw the open-source Adaptix C2 framework disguised as Nitro PDF software.
  • The July 20 window also changed the notification file to open an invisible 1-pixel pop-up pointing to a WebDAV resource on an attacker server. Rendering it can leak the user's NetNTLMv2 response without any program running.
  • AnyViewer uses the same update flow. The detections described involve Backupper, and the lab examined version 8.3.0. Neither report lists affected versions.
  • Timeline: ManageEngine first detected the activity on May 28 and notified AOMEI on June 7. AOMEI first blamed in-transit interception, which the lab rejected. Mandiant notified AOMEI on July 17. AOMEI reported corrective action on July 29. ManageEngine had not independently confirmed containment.
  • IOCs: domains storage-data[.]com, promotion.storage-data[.]com and aomei.storage-data[.]com; IPs 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117.

Remediation

  • Hunt across the whole April-to-July 2026 period. Do not rely on the vendor's current download page, because it serves genuine content almost all the time.
  • Look for the scheduled tasks RadminComponentRuntime and NitroRuntime, an unsigned upgrade-now.exe carrying AOMEI publisher details, any program running from Backupper's html pop-up folder, and attacker files under the local Radmin application-data folder.
  • Preserve files cached in the program's folders and check network logs for what was served at the time of an alert.
  • Block the listed domains and IPs. Block outbound SMB (TCP 445) and WebDAV to external addresses to stop NetNTLMv2 leakage.
  • Apply the YARA rules from GTIG and the Sigma rules from ManageEngine. The Hacker News has not tested them.

Linha do tempo

  1. thehackernews.com ↗ · pub. 16/10/2026 13:43 · coletado 19/10 17:53 primeiro registro

    UNC7017 tampers with AOMEI Backupper update servers in short windows to deliver CROSSROAD and SHINYROAD backdoors

    ler a análise desta fonte

    Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed the campaign. GTIG confirmed three windows (May 28, July 16 and July 20) and believes there were more. It identified affected organizations in IT services, telecommunications and higher education across 11 countries, and says the real number is likely higher. AOMEI says it fixed its servers, but that does not clean machines that were already compromised. How the attacker gained write access to AOMEI's servers has not been disclosed.

    Technical Details

    • No vulnerability was exploited. Backupper does not cryptographically verify down_html.ini (update package and checksum) or Notifycfg.ini (pop-up content and what to run), and the checksum sits in the same unsigned file. Changing the two text files was enough.
    • The payload ran with the privileges of the AOMEI process. On the machines the lab examined, that was enough for system-wide installation, depending on how the service was running.
    • The CROSSROAD downloader unpacked a bundle into a local Radmin folder, created a scheduled task that runs every three hours, then deleted itself and restored the genuine local update file.
    • The bundle contained a genuine signed Radmin binary, which sideloads an attacker-built DLL that loads the SHINYROAD implant. SHINYROAD provides a remote shell and can fetch and run new code. It uses a single hard-coded C2 address with no fallback.
    • CROSSROAD stops if the host is in China or if it finds certain security agents. On some hosts GTIG later saw the open-source Adaptix C2 framework disguised as Nitro PDF software.
    • The July 20 window also changed the notification file to open an invisible 1-pixel pop-up pointing to a WebDAV resource on an attacker server. Rendering it can leak the user's NetNTLMv2 response without any program running.
    • AnyViewer uses the same update flow. The detections described involve Backupper, and the lab examined version 8.3.0. Neither report lists affected versions.
    • Timeline: ManageEngine first detected the activity on May 28 and notified AOMEI on June 7. AOMEI first blamed in-transit interception, which the lab rejected. Mandiant notified AOMEI on July 17. AOMEI reported corrective action on July 29. ManageEngine had not independently confirmed containment.
    • IOCs: domains storage-data[.]com, promotion.storage-data[.]com and aomei.storage-data[.]com; IPs 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117.

    Remediation

    • Hunt across the whole April-to-July 2026 period. Do not rely on the vendor's current download page, because it serves genuine content almost all the time.
    • Look for the scheduled tasks RadminComponentRuntime and NitroRuntime, an unsigned upgrade-now.exe carrying AOMEI publisher details, any program running from Backupper's html pop-up folder, and attacker files under the local Radmin application-data folder.
    • Preserve files cached in the program's folders and check network logs for what was served at the time of an alert.
    • Block the listed domains and IPs. Block outbound SMB (TCP 445) and WebDAV to external addresses to stop NetNTLMv2 leakage.
    • Apply the YARA rules from GTIG and the Sigma rules from ManageEngine. The Hacker News has not tested them.