AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
Malware
AdaptAgent
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 20, 2026
- Last mentioned5d ago
Timeline
2 articles · newest firstUNC7017 hijacks AOMEI updates for minutes to plant backdoors
Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.
76
Appears with
- UNC7017threat actor · 2
- ShinyRoadmalware · 2
- Mandiantorganization · 2
- AOMEI Backupperproduct · 2
- Google Threat Intelligence Grouporganization · 2
- CrossRoadmalware · 2
- ManageEngineorganization · 1
- AOMEIvendor · 1
- ManageEngine Threat Analysis Laborganization · 1
- Radminproduct · 1
- Radmin Serverproduct · 1
- AOMEI Technologyvendor · 1
- Adaptix C2malware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.