A software supply chain campaign that hijacked AOMEI Technology’s update infrastructure to distribute hidden backdoors.
Tracked as UNC7017, the attackers briefly altered server configurations between April and July 2026, then restored legitimate content before conventional security checks could reliably capture the compromise.
ManageEngine’s Threat Analysis Lab initially detected suspicious activity through endpoint telemetry on May 28, helping investigators reconstruct infections that subsequent checks of the vendor’s servers could not reproduce.
Observed victims included IT services, telecommunications and higher education organizations across eleven countries, including India, Australia, Brazil and the United States.
Exposure was opportunistic: systems polling the compromised infrastructure during an active tampering window could receive malware, meaning the identified victims probably represent only part of the campaign’s reach.
Rather than permanently modifying released binaries, UNC7017 weaponized two configuration files controlling downloads and notifications: down_html.ini and Notifycfg.ini.
The first specified the package location and expected MD5 checksum; the second directed the notification component toward content capable of triggering local execution.
Attackers changed the download destination, incremented version values and supplied a matching checksum for their malicious archive.
Because the client did not independently authenticate these configurations, replacing both the package reference and its integrity value allowed the trojanized download to pass the application’s checks.
No memory corruption exploit or CVE was required.
Confirmed exposure windows lasted ten minutes on May 28, six minutes on July 16 and five minutes on July 20.
Google Threat Intelligence Group Researchers said that, the campaign delivered the CROSSROAD downloader and SHINYROAD backdoor through trusted software workflows associated with AOMEI Backupper and AnyViewer.
Authentic configurations returned afterward, leaving investigators examining clean infrastructure while endpoint records preserved evidence of earlier compromise. Continuous monitoring ultimately captured malicious content during delivery.
The malicious upgrade-now.zip carried upgrade-now.exe, identified as CROSSROAD.
The downloader validated its execution environment, retrieved additional components and created RadminComponentRuntime, a scheduled task configured to launch a Radmin executable every three hours.
It subsequently deleted itself, reducing recoverable forensic evidence.
The next stage abused a legitimate, signed Radmin launcher to load the attacker’s BlkScrDl.dll through DLL search-order hijacking.
Additional components decrypted an embedded PocketPy payload, enabling outbound command-and-control communications, shell execution and delivery of further code without relying on an active Radmin listener.
Infrastructure evolved from Alibaba Cloud storage to vendor-themed domains and Google Cloud Storage.
Later activity introduced Adaptix C2 tooling disguised as Nitro PDF components, complicating defenses based solely on domain reputation or recognizable malware filenames.
A separate July 20 modification replaced promotional content with an invisible window referencing an attacker-controlled WebDAV resource.
This could coerce transmission of NetNTLMv2 authentication material even when the malware execution chain failed or was blocked.
The operation differs from the SolarWinds and 3CX compromises, which distributed trojanized software components: UNC7017 manipulated configuration-driven delivery without needing persistent changes to released application binaries.
AOMEI reported corrective infrastructure action, but ManageEngine had not independently verified containment when publishing its investigation.
Defenders should examine historical telemetry for executables launched from AOMEI rendering directories, unexpected Radmin DLLs and suspicious scheduled tasks.
Server remediation does not remove previously installed backdoors, and a clean configuration retrieved today cannot show what an endpoint downloaded in an earlier five-minute window or whether the notification channel exposed credentials.
| File / Description | SHA-256 |
|---|---|
| upgrade-now.zip (May 20 CROSSROAD Archive) | 6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7 |
| upgrade-now.exe (May 20 CROSSROAD Loader) | 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad |
| upgrade-now.exe (July 16 CROSSROAD Loader) | 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 |
| upgrade-now.exe (July 20 CROSSROAD Loader) | b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities…
Melbourne, Florida, November 5th, 2026, CyberNewswire OpenMatter Network, a pioneer in decentralized infrastructure for agentic…
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China's…