Security Intelligence
Loading table of contents...
At a glance:
-
On October 15, Google disclosed a supply chain campaign targeting AOMEI Technology's update infrastructure between April and July 2026.
-
The activity was attributed to threat actor UNC7017, which distributed the CROSSROAD downloader and SHINYROAD backdoor through temporary modifications to AOMEI update services.
-
Organizations that used AOMEI Backupper and checked for updates during the brief compromise windows were at risk of receiving malware from trusted vendor infrastructure.
Threat summary
On October 15, 2026, Google Threat Intelligence Group (GTIG) disclosed a software supply chain campaign targeting the update infrastructure of AOMEI Technology. The affected infrastructure supported:
-
AOMEI Backupper, a Windows backup, disk cloning, and disaster recovery platform
-
AnyViewer, a remote desktop and remote support application
Both products rely on the same ABMarket update mechanism and associated background services, including Backupper.exe and ABNotify.exe, which periodically connect to AOMEI-operated servers over HTTPS to retrieve update notifications and promotional content.
Between April and July 2026, threat actor UNC7017 repeatedly modified two configuration files hosted on that infrastructure for periods lasting five to ten minutes. Systems that checked for updates during those windows received malicious instructions, while systems that connected before or after received legitimate content.
Researchers observed compromise windows on May 28, July 16, and July 20, 2026.
The modified configuration files redirected AOMEI clients to download a malicious ZIP archive from adversary-controlled infrastructure and automatically execute its contents through the application's notification workflow.
The archive contained a downloader tracked as CROSSROAD, which performs environment checks, retrieves additional payloads, creates a scheduled task for persistence, and removes itself from disk. The scheduled task launches SHINYROAD, a modular backdoor that provides remote access while operating through a legitimate signed Radmin component.
Researchers also observed deployment of the Adaptix command-and-control framework during later stages of the campaign, disguised as Nitro PDF-related software.
On July 20, 2026, UNC7017 introduced a second technique by modifying the notification configuration file to display an invisible one-pixel popup that directed systems to a remote Web Distributed Authoring and Versioning (WebDAV) resource. This activity caused affected systems to transmit New Technology LAN Manager (NTLM) authentication hashes to infrastructure controlled by the threat actor, creating a credential collection path in addition to malware delivery.
GTIG identified affected organizations in information technology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.
The campaign targeted any system that queried the update infrastructure during an active tampering window, indicating the victim pool may extend beyond the organizations directly identified during the investigation.
Analysis
Organizations using AOMEI Backupper on backup servers, recovery systems, and administrator workstations would be the most exposed. These systems often hold privileged access and visibility into large parts of the environment, making them attractive targets for threat actors seeking access to sensitive data or additional systems within the network.
What makes this campaign notable is that UNC7017 did not need to compromise customer environments directly. By modifying configuration files on AOMEI's infrastructure, the actor was able to control where clients downloaded content from, what files were accepted as valid updates, and what content was executed. Affected systems carried out those actions through their normal update workflow.
This campaign reflects a broader shift toward attacks that abuse existing trust relationships. Earlier supply chain attacks, such as SolarWinds and 3CX, altered software code and left signatures in official files. This campaign altered only configuration files for minutes at a time, so vendor audits and file scanners find clean content. Backup and remote support tools run with broad access on managed systems, and harvested NTLM hashes add credential exposure across client environments. A vendor fix on the server side leaves already-infected endpoints in place.
In the recent ConnectWise Cloud Backup incident, threat actors leveraged a compromised application identity that already had access to customer Microsoft 365 environments. In both cases, the initial access was enabled by permissions and trust that already existed before the compromise occurred.
These incidents highlight the growing importance of understanding where third-party applications, update services, and other trusted platforms have access within the environment and what impact could result if those relationships are compromised.
For defenders, the primary challenge is determining exposure. Two systems running the same version of AOMEI Backupper could have experienced very different outcomes based solely on when they contacted the update infrastructure.
As a result, exposure depends less on software version and more on identifying which systems communicated with AOMEI services during the documented compromise windows between April and July 2026.
Mitigations
Review systems running AOMEI Backupper or AnyViewer between April and July 2026 and identify hosts that communicated with AOMEI update services during that period. Exposure depended on when systems checked for updates rather than software version alone, making historical endpoint, proxy, and network telemetry important for determining whether a device may have received malicious content.
Identify systems associated with the CROSSROAD/SHINYROAD infection chain by:
-
Reviewing for scheduled tasks such as RadminComponentRuntime and NitroRuntime
-
Examining AOMEI application directories for unexpected executables
-
Reviewing historical EDR telemetry for activity involving Backupper.exe, ABNotify.exe, upgrade-now.exe, and Radmin-related components
These artefacts can help establish whether a system progressed beyond the initial delivery stage.
Review authentication activity associated with systems that communicated with AOMEI infrastructure during the July 20, 2026 compromise window. This can help identify accounts potentially exposed through the Web Distributed Authoring and Versioning (WebDAV)-based credential collection activity observed during the campaign and support broader credential exposure assessments.
Review historical network, proxy, and security telemetry for connections to infrastructure, domains, user agents, and other indicators associated with the campaign. Monitoring updater processes for unsigned child processes and unexpected outbound connections originating from AOMEI-related directories can help identify systems affected during the short-lived tampering windows.
GTIG, Mandiant, and ManageEngine Threat Analysis Lab (METAL) have published indicators of compromise, detection guidance, and hunting artefacts that can support investigation activities.
AOMEI reported taking corrective actions in July 2026. Organizations using AOMEI Backupper can verify they are running current software and using the vendor's remediated update infrastructure.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
