AOMEI Backupper update servers briefly swapped for a CROSSROAD/SHINYROAD backdoor (UNC7017) — May–Jul 2026 five-to-ten-minute windows; Australia among 11 countries; server fixed, infected hosts still need hunting
Google Threat Intelligence Group (GTIG) and Mandiant, working with ManageEngine's Threat Analysis Lab, disclosed on 15 October 2026 that AOMEI Technology's origin update servers for AOMEI Backupper were repeatedly tampered with between April and July 2026. In confirmed windows on 28 May (10 minutes), 16 July (6 minutes) and 20 July (5 minutes) UTC, attackers briefly changed the unsigned down_html.ini and Notifycfg.ini files that Backupper polls over HTTPS so any client that checked for an update during those minutes downloaded and ran a trojanised package. There was no software vulnerability: the client trusted the MD5 checksum inside the same unsigned configuration file that named the download. GTIG tracks the cluster as UNC7017. On hit machines a CROSSROAD downloader staged a signed Radmin binary beside an attacker DLL that loaded the SHINYROAD implant (later Adaptix C2 on some hosts), set a scheduled task, and restored the local update file so the machine looked clean while the vendor's download page also looked clean again within minutes. GTIG telemetry spans IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States; victimology is opportunistic. AOMEI told Mandiant on 29 July that it had secured the servers; ManageEngine said it had not independently confirmed containment as of publication. Backupper's changelog through 8.5.0 (9 Oct) lists no change to update verification. Primary: Google Cloud / GTIG (15 Oct); vendor analysis: ManageEngine Threat Analysis Lab; wire: The Hacker News (16 Oct).
- Product
- AOMEI Backupper (Windows backup / disk-cloning); AnyViewer uses the same update flow (detections described are Backupper)
- Versions
- Observed on Backupper 8.3.0 and later in the ManageEngine write-up; neither report lists a fixed client version. Vendor changelog through 8.5.0 (9 Oct 2026) does not describe a change to update verification.
- Exploited in Australia?
- unknown
- Patch to
- Do not treat a clean AOMEI download page as proof of safety. Hunt for scheduled tasks RadminComponentRuntime or NitroRuntime, unsigned upgrade-now.exe carrying AOMEI publisher details, programs under Backupper's html pop-up folder, and staging under the local Radmin application-data folder across April–July 2026. Block outbound to storage-data.com / promotion.storage-data.com / aomei.storage-data.com and IPs 8.210.84.56, 8.218.65.184, 47.239.60.117; block outbound SMB (TCP 445) and WebDAV to external hosts. Apply GTIG YARA and ManageEngine Sigma rules from the reports. Prefer signed, cryptographically verified update channels for backup and remote-admin tools.
Primary: Google Threat Intelligence / Mandiant — Investigating ephemeral supply-chain tampering (AOMEI / UNC7017, 15 Oct 2026) · Vendor: ManageEngine Threat Analysis Lab — AOMEI Backupper supply-chain compromise (coordinated with GTIG/Mandiant) · The Hacker News — Attackers tampered with AOMEI Backupper's update servers for minutes to deliver a backdoor (16 Oct 2026)