UNC7017 Executes AOMEI Supply Chain Attack Using Five-Minute Server Tampering
Do Son 
TL;DR
Threat actors executed a stealthy AOMEI supply chain attack between April and July 2026 by modifying official software update files for just five to ten minutes at a time. During these brief windows, the AOMEI supply chain attack UNC7017 campaign delivered the CROSSROAD downloader and SHINYROAD backdoor to unsuspecting enterprise systems. Although AOMEI Technology secured its update servers after researchers reported the breach, previously infected computers remain at risk.
What Happened in the Campaign
Between April 2026 and July 2026, attackers targeted the update servers for AOMEI Backupper and AnyViewer. According to an investigation by Google Threat Intelligence Group and Mandiant, the intruders altered two remote configuration files named down_html.ini and Notifycfg.ini. Rather than leaving malicious code on the servers permanently, the hackers modified the files for only five to ten minutes before restoring the clean versions. Specifically, investigators confirmed a 10-minute tampering window on May 28, a six-minute window on July 16, and a five-minute window on July 20.
Independent telemetry from the ManageEngine Threat Analysis Lab (METAL) first spotted the anomalous activity in late May 2026. METAL researchers noted that the attack exploited no software vulnerabilities or memory corruption flaws. Instead, the attackers abused a design gap because the desktop client did not cryptographically verify the remote configuration files. During the July 16 window, the hackers also injected over 35,000 dummy lines into Notifycfg.ini to bypass local version checks and force immediate execution.
The CROSSROAD and SHINYROAD Payload Chain
Systems polling the AOMEI servers during an active window downloaded a trojanized archive named upgrade-now.zip. This archive contained a 64-bit C downloader that GTIG tracks as CROSSROAD. Once launched, CROSSROAD checked the victim’s external IP address and halted execution if the machine resolved to China. For all other targets, the loader restored the local configuration files to hide its tracks and deleted itself from the disk.
Before deleting itself, CROSSROAD unpacked a legitimate Famatech Radmin 3.x utility into the local application data folder. It also created a scheduled task named RadminComponentRuntime to run every three hours. When the signed Radmin binary ran, it side-loaded a malicious DLL named BlkScrDl.dll. Consequently, this file decrypted and ran the SHINYROAD backdoor in memory using an embedded PocketPy Python interpreter. In mid-July 2026, the attackers also deployed the Adaptix C2 framework disguised as a Nitro PDF tool, alongside an invisible one-by-one-pixel popup designed to steal NetNTLMv2 password hashes via WebDAV.
Who Is Behind the Activity
GTIG and Mandiant attribute this operation to a newly tracked threat cluster named UNC7017. While researchers have not linked UNC7017 to a known nation-state group, the malware’s geolocation check specifically avoids infecting systems located in China. “A defining characteristic of UNC7017’s operational security is its reliance on ephemeral, time-compressed server modifications,” GTIG researchers wrote.
Additionally, UNC7017 rotated its hosting infrastructure to evade network blocks. In April and May 2026, the group hosted payloads on Alibaba Cloud Object Storage. By early July, they switched to lookalike domains such as storage-data.com. Finally, during the July 20 wave, the actors hosted the initial archive on Google Cloud Storage to bypass security filters that block newly registered domains.
Impact and Global Scale
Because the tampered servers infected any client checking for updates during the active windows, victim selection was largely opportunistic. Nevertheless, confirmed victims span IT services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkiye, and the United States. “At the conclusion of each window, UNC7017 reverted both down_html.ini and Notifycfg.ini to their legitimate contents,” the report stated. Because the server files looked clean minutes later, many security analysts mistakenly dismissed real alerts as false positives.
How Organizations Can Stay Protected
Mandiant notified AOMEI Technology on July 17, 2026, and the vendor confirmed server remediation on July 29. However, fixing the origin servers does not clean endpoints already compromised during the AOMEI supply chain attack. Therefore, defenders should inventory all AOMEI Backupper and AnyViewer installations across their networks. Security teams must hunt for unauthorized scheduled tasks named RadminComponentRuntime or NitroRuntime. Finally, administrators should block connections to storage-data.com, 8.210.84.56, and 8.218.65.184, while restricting outbound SMB and WebDAV traffic to external IP addresses.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
