Google Reports UNC7017 Supply-Chain Campaign Targeting AOMEI Updates
Summary
Google says UNC7017 tampered with AOMEI update configurations in 2026 to deliver the CROSSROAD downloader and SHINYROAD backdoor, and later used a WebDAV resource to collect NTLM hashes. The article also outlines exposure checks and mitigations.
Key points
- GTIG reported that UNC7017 modified AOMEI update configuration files for brief periods between April and July 2026, affecting the shared ABMarket update mechanism used by AOMEI Backupper and AnyViewer.
- Clients checking for updates during the observed tampering windows could be redirected to a malicious ZIP archive and execute its contents through the normal notification workflow.
- The archive delivered CROSSROAD, which checks the environment, retrieves additional payloads, creates a scheduled task, and removes itself; the task launches the SHINYROAD backdoor through a signed Radmin component.
- Researchers also observed the Adaptix command-and-control framework disguised as Nitro PDF-related software.
- On July 20, a modified notification configuration directed systems to a WebDAV resource, causing them to transmit NTLM authentication hashes to actor-controlled infrastructure.
- GTIG identified affected organizations across IT services, telecommunications, and higher education in 11 countries, and said the potential victim pool may be larger.
- The article recommends reviewing historical network and endpoint telemetry from April through July, checking for related scheduled tasks and executables, and assessing authentication activity during the July 20 window. AOMEI reported corrective actions in July 2026.
Article Details
- Attack Vectors
- UNC7017 temporarily modified configuration files on AOMEI update infrastructure, redirecting AOMEI clients to an attacker-controlled download for a malicious ZIP archive.
- The ZIP archive delivered CROSSROAD, which retrieved additional payloads and created a scheduled task to launch SHINYROAD.
- On July 20, 2026, a modified notification configuration displayed an invisible one-pixel popup directing systems to a WebDAV resource, causing NTLM authentication hashes to be sent to threat-actor-controlled infrastructure.
- Adaptix was deployed during later campaign stages and disguised as Nitro PDF-related software.
- Defensive Notes
- Review systems running AOMEI Backupper or AnyViewer between April and July 2026, correlating historical endpoint, proxy, and network telemetry with communications to AOMEI update services.
- Check for scheduled tasks named RadminComponentRuntime and NitroRuntime, unexpected executables in AOMEI application directories, and historical activity involving Backupper.exe, ABNotify.exe, upgrade-now.exe, and Radmin-related components.
- Review authentication activity for systems that communicated with AOMEI infrastructure during the July 20, 2026 compromise window to assess possible NTLM hash exposure.
- Investigate historical connections to campaign-associated infrastructure and monitor updater processes for unsigned child processes and unexpected outbound connections from AOMEI-related directories.
- Verify that AOMEI Backupper is current and using AOMEI's remediated update infrastructure; a server-side fix does not remove malware already present on endpoints.
MITRE ATT&CK
T1036 · MasqueradingAdaptix was disguised as Nitro PDF-related software during later stages of the campaign.T1053.005 · Scheduled TaskCROSSROAD created a scheduled task that launched SHINYROAD.T1105 · Ingress Tool TransferAOMEI clients were redirected to download a malicious ZIP archive, and CROSSROAD retrieved additional payloads.T1187 · Forced AuthenticationA modified notification configuration directed systems to a WebDAV resource, causing them to transmit NTLM authentication hashes to threat-actor-controlled infrastructure.T1195.002 · Compromise Software Supply ChainUNC7017 compromised AOMEI's update infrastructure by temporarily modifying configuration files that directed clients to malicious content.T1565.001 · Stored Data ManipulationThe actor altered configuration files hosted on AOMEI infrastructure so clients received malicious update instructions during brief compromise windows.
Threat Actors
Malware
CROSSROADThe activity was attributed to threat actor UNC7017, which distributed the CROSSROAD downloader and SHINYROAD backdoor through temporary modifications to AOMEI update services.SHINYROADThe activity was attributed to threat actor UNC7017, which distributed the CROSSROAD downloader and SHINYROAD backdoor through temporary modifications to AOMEI update services.
Vendors
Products
ABMarketBoth products rely on the same ABMarket update mechanism and associated background services, including Backupper.exe and ABNotify.exe, which periodically connect to AOMEI-operated servers over HTTPS to retrieve updateAnyViewerAnyViewer, a remote desktop and remote support applicationAOMEI BackupperOrganizations that used AOMEI Backupper and checked for updates during the brief compromise windows were at risk of receiving malware from trusted vendor infrastructure.Nitro PDFResearchers also observed deployment of the Adaptix command-and-control framework during later stages of the campaign, disguised as Nitro PDF-related software.RadminThe scheduled task launches SHINYROAD, a modular backdoor that provides remote access while operating through a legitimate signed Radmin component.
Tools
Countries
Australiaorganizations in information technology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the UnitedBrazilin information technology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.Indiain information technology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.Pakistantechnology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.Portugaltechnology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.Singaporeservices, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.South Africaand higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.Spainand higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.Switzerlandhigher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.Türkiyeacross Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.United StatesBrazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.
Industries
Higher EducationGTIG identified affected organizations in information technology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland,Information technology servicesGTIG identified affected organizations in information technology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland,TelecommunicationsGTIG identified affected organizations in information technology services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland,