UNC7017 Briefly Tampered With AOMEI Updates to Deliver Backdoors

UNC7017 swapped AOMEI update configs for minutes in 2026 so polling clients downloaded CROSSROAD and the SHINYROAD backdoor.

Google Threat Intelligence Group and Mandiant investigated UNC7017 tampering with AOMEI Technology update infrastructure, with ManageEngine also cited by later coverage. The actor briefly replaced unsigned down_html.ini and Notifycfg.ini—files that name the update package and its checksum—for five to ten minutes, then restored legitimate files so clients polling in those windows downloaded a malicious ZIP. Google’s account covers April through July 2026 and both AOMEI Backupper and AnyViewer, while The Hacker News lists confirmed windows on May 28, July 16, and July 20, 2026 and discusses Backupper. The package deployed CROSSROAD, which scheduled signed Radmin—every three hours, according to The Hacker News—to side-load the modular SHINYROAD backdoor, described as offering a remote shell and able to fetch more code, including Adaptix C2 presented as Nitro PDF. Impacted organizations included IT services, telecommunications, and higher education; Google said at least 11 countries and opportunistic selection, while The Hacker News said 11 countries and no named state link for UNC7017. AOMEI said the distribution servers were secured after notification, but that repair does not remove existing implants, and a July 20 WebDAV prompt was also reported as able to leak NetNTLMv2 responses without executing malware.

• UNC7017 altered AOMEI update configs down_html.ini and Notifycfg.ini for five-to-ten-minute windows, then restored the legitimate files.
• Google Threat Intelligence Group described activity from April through July 2026 affecting AOMEI Backupper and AnyViewer; The Hacker News, citing GTIG, Mandiant, and ManageEngine, listed confirmed windows on May 28, July 16, and July 20,…
• Sources said no software flaw was exploited: the swapped files were unsigned and named the package and its checksum.
• The malicious ZIP deployed the CROSSROAD downloader, which used a scheduled task—every three hours, per The Hacker News—to launch signed Radmin and side-load the modular SHINYROAD backdoor.
• SHINYROAD can provide a remote shell and fetch further code, including Adaptix C2 disguised as Nitro PDF.
• A July 20 WebDAV pop-up was reported as able to expose NetNTLMv2 authentication responses without running malware.
• Victims were opportunistic and included IT services, telecommunications, and higher education in at least 11 countries according to Google; The Hacker News said 11 countries and that UNC7017 has no named state link.
• AOMEI said it secured distribution servers after notification; repairing those servers does not remove existing implants.