A Precision Strike Built for Invisibility
AOMEI Backupper is no niche utility: more than 100 million users rely on it to protect their data. That scale — and the institutional trust it commands — is exactly what threat actor UNC7017 exploited between April and July 2026. The group tampered with configuration files on AOMEI's update servers during windows of just five to ten minutes. Three incidents have been confirmed by Google Threat Intelligence Group (GTIG): ten minutes on May 28, six minutes on July 16, and five minutes on July 20. Short enough to evade real-time detection. Long enough to infect every endpoint that happened to check for updates at the wrong moment.
Brevity as an Evasion Technique
UNC7017's core tactical innovation was this calculated brevity. Traditional security tooling relies on periodic snapshots: a file that looks clean at 9:01 a.m. and still looks clean at 9:12 a.m. raises no alert — even if it was used to compromise thousands of endpoints in between. The attackers manipulated two configuration files on AOMEI's infrastructure: the first redirected update downloads to a malicious ZIP archive hosted on attacker-controlled servers; the second instructed the application to execute whatever it downloaded. Once the tampering window closed, AOMEI's servers reverted to their legitimate files — but every machine that had queried them in the interim remained permanently compromised.
The CROSSROAD → SHINYROAD Kill Chain
The ZIP archive delivered to victims contained CROSSROAD, a dropper designed to validate the target environment before deploying the next-stage payload. CROSSROAD then installed SHINYROAD, a modular backdoor engineered for low-profile remote access. Its persistence mechanism is particularly notable: SHINYROAD does not execute directly. Instead, it leverages the legitimate, signed binary of Radmin 3.x — a remote administration tool developed by Famatech — to perform DLL sideloading. A malicious library placed alongside the Radmin binary is loaded at launch, decrypts SHINYROAD in memory via an embedded Python interpreter (PocketPy), and registers the implant inside a signed system process. A scheduled task named RadminComponentRuntime fires every three hours to ensure the backdoor survives reboots.
Credential Theft as a Bonus Payload
Alongside the backdoor, the attackers deployed a NetNTLMv2 hash-stealing technique via WebDAV: a one-pixel-by-one-pixel invisible window silently triggered a Windows authentication attempt, harvesting credentials without executing any code visible to behavioral detection engines. Those hashes can subsequently be leveraged in pass-the-hash or relay attacks, granting lateral movement across the internal network without triggering alerts on compromised endpoints.
Organizations in eleven countries have been confirmed compromised — Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkey, and the United States — across the IT, telecommunications, and higher education sectors.
Immediate Actions for IT and Security Teams
AOMEI has secured its servers, but machines infected between April and July 2026 remain active in the wild. Priority actions:
- Audit all AOMEI Backupper and AnyViewer installations across your estate
- Hunt for scheduled tasks named
RadminComponentRuntimeorNitroRuntime - Check for
upgrade-now.exeorupgrade-now.zipfiles in AOMEI directories - Block connections to
storage-data.comand associated IPs (8.210.84.56, 47.239.60.117, 8.218.65.184) - Restrict outbound SMB and WebDAV traffic to unlisted external IP addresses
This attack signals a fundamental shift in the threat landscape: the risk is no longer confined to phishing emails or unpatched CVEs — it now lives inside the trust mechanisms organizations depend on daily. Extending integrity controls to the update pipelines of third-party tools, particularly those deployed silently at scale across employee workstations, is no longer a nice-to-have for security teams. It is a baseline requirement.