UNC7017 hijacked AOMEI updates to install CROSSROAD and SHINYROAD
Original title: Google Uncovers Hackers Hijacking Legitimate Software Updates to Deploy Hidden Backdoors
Five- to ten-minute tampering windows in May and July 2026 exposed organizations in eleven countries without a CVE.
Google and ManageEngine say UNC7017 briefly changed AOMEI update configuration files between April and July 2026, then restored legitimate content. Clients polling during those windows could receive the CROSSROAD downloader, which scheduled a signed Radmin launcher to load the SHINYROAD backdoor through DLL search-order hijacking. A July 20 change could also draw NetNTLMv2 authentication material from a WebDAV resource. AOMEI reported remediation, but ManageEngine had not independently verified containment.
Unconfirmed: ManageEngine had not independently verified AOMEI's reported containment when it published.
- Confirmed windows lasted ten, six and five minutes on May 28, July 16 and July 20.
- Attackers changed down_html.ini and Notifycfg.ini, including the expected MD5.
- Affected sectors included IT services, telecommunications and higher education.
- Later activity used Adaptix C2 tooling disguised as Nitro PDF components.
- A clean configuration today cannot reveal an earlier malicious download.
Impact: Installed backdoors and possible NetNTLMv2 credential exposure
| Product | Affected |
|---|---|
| AOMEI Technology AOMEI Backupper | — |
| AOMEI Technology AnyViewer | — |
- 1.Review telemetry for executables launched from AOMEI rendering directories.
- 2.Hunt for unexpected Radmin DLLs and the RadminComponentRuntime scheduled task.
- 3.Do not treat server cleanup as removal of previously installed backdoors.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1574.001 DLL Search Order HijackingT1053.005 Scheduled TaskT1187 Forced Authentication
- Vendors
- AOMEI Technology
- Products
- AOMEI BackupperAnyViewerRadmin
- Threat actors
- UNC7017
- Malware
- CROSSROADSHINYROADAdaptix C2
- Organizations
- Google Threat Intelligence GroupManageEngine
- Countries
- IndiaAustraliaBrazilUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad | 635e54f8df0f6eec7 upgrade-now.exe (May 20 CROSSROAD Loader) 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad upgrade-now.exe (July 16 CROSSROAD Loader) 9a58e8f49edf5644 |
| sha256 | 6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7 | cription SHA-256 upgrade-now.zip (May 20 CROSSROAD Archive) 6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7 upgrade-now.exe (May 20 CROSSROAD Loader) 11e576df44e9c9eef |
| sha256 | 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 | 231e5b0987b913ad upgrade-now.exe (July 16 CROSSROAD Loader) 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 upgrade-now.exe (July 20 CROSSROAD Loader) b360b6db0c2b6683 |
| sha256 | b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21 | 9d927963c7aca450 upgrade-now.exe (July 20 CROSSROAD Loader) b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21 Note: IP addresses and domains are intentionally defanged ( |
From the original article
3 min read at gbhackers.com
A software supply chain campaign that hijacked AOMEI Technology’s update infrastructure to distribute hidden backdoors. Tracked as UNC7017, the attackers briefly altered server configurations between April and July 2026, then restored legitimate content before conventional security checks could reliably capture the compromise.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.