Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
Google Threat Intelligence Group, Mandiant, and ManageEngine said UNC7017 altered AOMEI Backupper update files for five-to-ten-minute windows on May 28, July 16, and July 20, 2026, so clients polling then downloaded a backdoor. No software flaw was exploited: unsigned down_html.ini and Notifycfg.ini both named the package and held its checksum. The CROSSROAD downloader created a task running every three hours that launched signed Radmin to side-load SHINYROAD, which offers a remote shell and can fetch more code, including Adaptix C2 disguised as Nitro PDF. A July 20 WebDAV pop-up could also leak NetNTLMv2 authentication responses; affected organizations included IT, telecommunications, and higher education across 11 countries, and repairing the servers does not remove existing implants.