GajShield Threat Advisory — UNC7017 AOMEI Backupper Update Compromise (CROSSROAD / SHINYROAD)

Severity: High | Priority: 1

Attackers tracked by Google Threat Intelligence Group as UNC7017 repeatedly tampered with update files on AOMEI’s own servers. AOMEI Backupper is a widely used Windows backup and disk-cloning tool. During short windows on May 28, July 16 and July 20, 2026, any copy of AOMEI Backupper that checked for updates downloaded and ran a backdoor. Each window lasted only minutes, so the download page usually looks clean if you check it now. AOMEI’s AnyViewer remote-desktop tool uses the same update process.

The infection chain runs in this order:

1. The CROSSROAD downloader sets up a scheduled task named RadminComponentRuntime.
2. Every three hours, that task launches a genuine, signed copy of Radmin.
3. Radmin loads a malicious DLL that runs the SHINYROAD backdoor, which gives the attacker a remote shell and can fetch further code.
4. On selected machines, the attackers also installed the Adaptix C2 framework, disguised as Nitro PDF, with a scheduled task named NitroRuntime.
5. After July 20, the tampered update also tried to leak users’ Windows NetNTLMv2 credentials through an invisible WebDAV pop-up.

Known victims are IT services, telecommunications and higher-education organisations in 11 countries, including India.

If an alert is raised, treat the source machine as compromised. SHINYROAD uses only one hard-coded server, so blocking these addresses cuts the attacker’s control, but it does not clean the machine. Isolate the machine and check it for:

• the RadminComponentRuntime and NitroRuntime scheduled tasks
• files in the local Radmin application-data folder
• programs running from AOMEI Backupper’s HTML pop-up folder
• a file named upgrade-now.exe

Keep AOMEI’s cached update files, including down_html.ini and Notifycfg.ini, as evidence. Reimage the machine rather than cleaning it. Then reset the passwords of every user who logged on to it, because their NetNTLM credentials may have been captured.

Even if no alerts are raised, find every machine running AOMEI Backupper or AnyViewer. Hunt on those machines from April through July 2026 for the scheduled tasks and files listed above.

To prevent recurrence:

• Block outbound SMB (TCP 445) and WebDAV to the internet, which shuts off the credential-leak technique.
• Consider turning off automatic updates for AOMEI products. AOMEI’s latest release does not show any change to how updates are verified, so installing a new version does not close this gap.
• Install AOMEI updates manually after checking that the installer is signed.