/
← Voltar ao feed
high it services telecommunications higher education

UNC7017 hijacks AOMEI Backupper update servers to deliver CROSSROAD downloader and SHINYROAD backdoor

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 16:40 · coletado há 4 dias

Between April and July 2026, a threat actor tracked as UNC7017 compromised AOMEI update and notification infrastructure and used it to push malware to users of AOMEI Backupper. The attackers briefly altered two configuration files and restored them within minutes to evade detection. The campaign was uncovered by ManageEngine's Threat Analysis Lab (METAL) together with Google Threat Intelligence Group (GTIG) and Mandiant. It delivered a previously unknown downloader, CROSSROAD, and a backdoor, SHINYROAD. Victims were found in the US, Australia, India, Singapore, Spain and Switzerland, in IT services, telecommunications and higher education, and Google warns that other organizations that checked for updates during the exposure windows may also be affected. AOMEI says its CTO is leading an investigation and has not confirmed how the attackers got in.

Detalhes técnicos

  • Tampered files: https://www2.aomeisoftware.com/download/abpopup/down_html.ini (update package location) and https://account.aomeitech.com/Notifycfg.ini (notification control, can trigger execution).
  • The attackers redirected the software to a malicious ZIP archive and used the notification mechanism to run it without user interaction. They also altered the expected checksum so the archive passed the software's integrity check.
  • Confirmed exposure windows: May 28 (10 min, 05:40-05:50 UTC), July 16 (6 min, 08:33-08:39 UTC) and July 20 (5 min, 10:35-10:40 UTC).
  • Detection began on May 28, when AOMEI's promotion processes were seen installing the legitimate Radmin tool on machines at two unrelated companies.
  • CROSSROAD performs reconnaissance, downloads additional components and persists via a scheduled task. SHINYROAD abuses legitimate Radmin components to load malicious code and connect outbound to attacker C2.
  • On July 20, Google also observed a forced-authentication technique: an invisible popup made the notification system access an attacker-controlled WebDAV resource, exposing NTLM hashes.
  • Infrastructure: 8.210.84[.]56, serv.oss-cn-hongkong[.]aliyuncs.com, hostnames under storage-data[.]com, and abuse of storage.googleapis.com.
  • ManageEngine first notified AOMEI on June 7. AOMEI initially suggested interception in transit, which the researchers rejected because content was retrieved over HTTPS from AOMEI-owned hosts in different countries. Mandiant notified AOMEI on July 17, and AOMEI replied on July 29 that it had taken corrective action.

Remediação

  • A server-side fix does not remove malware already installed. Hunt for it on endpoints that ran AOMEI Backupper.
  • Review the IOCs published by Google and ManageEngine, including suspicious scheduled tasks, unexpected executables in AOMEI installation directories, and connections to the attacker infrastructure.
  • Treat hosts that may have contacted the WebDAV resource as having exposed NTLM hashes and reset the affected credentials.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 19/10/2026 16:40 · coletado 19/10 17:53 primeiro registro

    UNC7017 hijacks AOMEI Backupper update servers to deliver CROSSROAD downloader and SHINYROAD backdoor

    ler a análise desta fonte

    Between April and July 2026, a threat actor tracked as UNC7017 compromised AOMEI update and notification infrastructure and used it to push malware to users of AOMEI Backupper. The attackers briefly altered two configuration files and restored them within minutes to evade detection. The campaign was uncovered by ManageEngine's Threat Analysis Lab (METAL) together with Google Threat Intelligence Group (GTIG) and Mandiant. It delivered a previously unknown downloader, CROSSROAD, and a backdoor, SHINYROAD. Victims were found in the US, Australia, India, Singapore, Spain and Switzerland, in IT services, telecommunications and higher education, and Google warns that other organizations that checked for updates during the exposure windows may also be affected. AOMEI says its CTO is leading an investigation and has not confirmed how the attackers got in.

    Technical Details

    • Tampered files: https://www2.aomeisoftware.com/download/abpopup/down_html.ini (update package location) and https://account.aomeitech.com/Notifycfg.ini (notification control, can trigger execution).
    • The attackers redirected the software to a malicious ZIP archive and used the notification mechanism to run it without user interaction. They also altered the expected checksum so the archive passed the software's integrity check.
    • Confirmed exposure windows: May 28 (10 min, 05:40-05:50 UTC), July 16 (6 min, 08:33-08:39 UTC) and July 20 (5 min, 10:35-10:40 UTC).
    • Detection began on May 28, when AOMEI's promotion processes were seen installing the legitimate Radmin tool on machines at two unrelated companies.
    • CROSSROAD performs reconnaissance, downloads additional components and persists via a scheduled task. SHINYROAD abuses legitimate Radmin components to load malicious code and connect outbound to attacker C2.
    • On July 20, Google also observed a forced-authentication technique: an invisible popup made the notification system access an attacker-controlled WebDAV resource, exposing NTLM hashes.
    • Infrastructure: 8.210.84[.]56, serv.oss-cn-hongkong[.]aliyuncs.com, hostnames under storage-data[.]com, and abuse of storage.googleapis.com.
    • ManageEngine first notified AOMEI on June 7. AOMEI initially suggested interception in transit, which the researchers rejected because content was retrieved over HTTPS from AOMEI-owned hosts in different countries. Mandiant notified AOMEI on July 17, and AOMEI replied on July 29 that it had taken corrective action.

    Remediation

    • A server-side fix does not remove malware already installed. Hunt for it on endpoints that ran AOMEI Backupper.
    • Review the IOCs published by Google and ManageEngine, including suspicious scheduled tasks, unexpected executables in AOMEI installation directories, and connections to the attacker infrastructure.
    • Treat hosts that may have contacted the WebDAV resource as having exposed NTLM hashes and reset the affected credentials.