UNC7017 Compromises AOMEI Backupper Update Channel in Short-Burst Supply Chain Attacks Delivering CrossRoad and ShinyRoad
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it was opportunistic rather than targeted. Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine Threat Analysis Lab (METAL) identified compromised higher education, IT services and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. Google assesses that additional tampering likely occurred outside its visibility.
Technical Details
- UNC7017 modified the update server's update settings file to point to a malicious ZIP archive. It also altered the automatic notification service to force clients to execute the content.
- METAL found that the actor abused AOMEI's promotional content channel. Its background services poll AOMEI servers and have two configuration paths that deliver content to a directory and execute it. Neither configuration file is cryptographically authenticated by the client, and the archive checksum is declared inside the same unauthenticated file that names the archive.
- The payload was a legitimate Radmin Server binary alongside a malicious DLL that opens a reverse TCP connection to the attackers' C&C server.
- A secondary vector replaced a legitimate banner with a 1x1 pixel window at maximum execution priority. It forced the client to request a remote resource over WebDAV, leaking NetNTLMv2 hashes to the attackers.
- CrossRoad performs system validation, cleanup and payload staging, sets persistence for the final backdoor, and deletes itself from disk. The final payload is the ShinyRoad modular backdoor framework. In July, UNC7017 also dropped AdaptAgent, part of the Adaptix C2 post-exploitation framework.
- Timeline: METAL saw the potential attack path on May 28, observed the payload change in real time on July 16, and Mandiant caught the tampering on July 20.
- METAL notified AOMEI Technology in early June, but the vendor dismissed the report as in-transit interception. Google notified it again in mid-July, and AOMEI said in late July that it had taken corrective actions.
Remediation
The article gives no explicit remediation guidance. AOMEI reports having taken corrective actions. Defenders who ran AOMEI Backupper during the April to July 2026 window should hunt for the described payloads and consider NetNTLMv2 credential exposure.
Linha do tempo
-
UNC7017 Compromises AOMEI Backupper Update Channel in Short-Burst Supply Chain Attacks Delivering CrossRoad and ShinyRoad
ler a análise desta fonte ocultar
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it was opportunistic rather than targeted. Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine Threat Analysis Lab (METAL) identified compromised higher education, IT services and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. Google assesses that additional tampering likely occurred outside its visibility.
Technical Details
- UNC7017 modified the update server's update settings file to point to a malicious ZIP archive. It also altered the automatic notification service to force clients to execute the content.
- METAL found that the actor abused AOMEI's promotional content channel. Its background services poll AOMEI servers and have two configuration paths that deliver content to a directory and execute it. Neither configuration file is cryptographically authenticated by the client, and the archive checksum is declared inside the same unauthenticated file that names the archive.
- The payload was a legitimate Radmin Server binary alongside a malicious DLL that opens a reverse TCP connection to the attackers' C&C server.
- A secondary vector replaced a legitimate banner with a 1x1 pixel window at maximum execution priority. It forced the client to request a remote resource over WebDAV, leaking NetNTLMv2 hashes to the attackers.
- CrossRoad performs system validation, cleanup and payload staging, sets persistence for the final backdoor, and deletes itself from disk. The final payload is the ShinyRoad modular backdoor framework. In July, UNC7017 also dropped AdaptAgent, part of the Adaptix C2 post-exploitation framework.
- Timeline: METAL saw the potential attack path on May 28, observed the payload change in real time on July 16, and Mandiant caught the tampering on July 20.
- METAL notified AOMEI Technology in early June, but the vendor dismissed the report as in-transit interception. Google notified it again in mid-July, and AOMEI said in late July that it had taken corrective actions.
Remediation
The article gives no explicit remediation guidance. AOMEI reports having taken corrective actions. Defenders who ran AOMEI Backupper during the April to July 2026 window should hunt for the described payloads and consider NetNTLMv2 credential exposure.