Between April and July 2026, threat actors hijacked AOMEI’s update process—used in its Backupper tool—for mere minutes at a time to install backdoors via trusted software channels. These attacks, uncovered by Google Threat Intelligence Group (GTIG) and Mandiant, manipulated configuration files on AOMEI’s servers so that users checking for updates during tampering intervals would receive malicious payloads instead of genuine ones. The perpetrating group has been dubbed UNC7017.
How the Download Hijack Worked
AOMEI’s updater relies on two configuration files: down_html.ini, which dictates what version, checksum, and download link the client should use; and Notifycfg.ini, which governs how notifications are displayed and how local programs are launched. During the compromised windows, attackers made changes to both files to make the application download and execute a malicious ZIP archive instead of the intended update.
The windows were short and strategic—ten minutes on May 28, six on July 16, and five on July 20—followed by restoration of the original configurations. Because the live server appeared clean before and after those windows, traditional checks would miss the breach unless they happened during one of those periods.
Malware Chain: From CROSSROAD to SHINYROAD
The first-stage malware, dubbed CROSSROAD, was delivered as upgrade-now.exe, which performed system checks, downloaded additional payloads, established scheduled tasks, and removed its own executable. From there, the attackers used a legitimate remote administration tool called Radmin, placing a malicious DLL (BlkScrDl.dll) next to it and loading it during startup. That DLL then launched a backdoor named SHINYROAD. Additionally, ADAPTAGENT—part of the Adaptix command-and-control framework—was disguised as Nitro PDF software in later stages.
On July 20, a further twist appeared: attackers added a one-pixel WebDAV notification window, invisible to users, which forced an AOMEI client to attempt authentication to a remote server. This triggered exposure of NetNTLMv2 credentials without prompting or clear notice.
Scope, Impact, and Mitigation
The campaign affected multiple sectors and countries, with India explicitly named, though the full list of compromised computers remains unknown. Detection of the operation began through telemetry work by ManageEngine’s Threat Analysis Lab in late May. AOMEI says it has since secured its distribution servers.
The cleanup is nontrivial: systems impacted in those windows may still harbor malicious files. Guidance urges organizations to audit endpoint and network logs for signs of the installer’s child processes, Radmin or Nitro-related scheduled tasks, and outgoing communications tied to known indicators. Cached configuration files and proxy/firewall logs should also be reviewed—even though the server now returns legitimate settings.
Security Lessons Learned
The incident shows that even brief interventions in trusted software supply chains can cause long-lasting damage. The attackers never exploited a software bug or required user action; instead, they hijacked infrastructure. HTTPS channels and unsigned checksums on configuration files proved insufficient safeguards.
Strong mitigation steps include using cryptographically signed configuration files, verifying downloads with robust methods, constraining which domains an updater can access, and separating UI notification systems from execution capabilities.
What this means: updates should be treated as a critical part of a product’s attack surface. Even trusted vendors need multi-layered protections—digital signatures, locked-down download domains, independent verification of code. This is a warning to everyone in software supply chains: a five-minute breach can leave behind weeks of forensic work. Moving forward, the focus must be on building resilient update architectures and continuous monitoring rather than assuming trust inherent in any single tech vendor.
