AOMEI Backupper and AnyViewer update files tampered with for five to ten minutes at a time between April and July 2026 to push the CROSSROAD downloader and the SHINYROAD backdoor, with Switzerland among 11 countries GTIG names
GTIG: AOMEI update files were altered for minutes at a time to push a backdoor; Switzerland among victim countries
Defender actions
- Inventory every Windows host that runs AOMEI Backupper or AnyViewer and check each for scheduled tasks named RadminComponentRuntime or NitroRuntime, a Radmin directory under the user's local application data and cached update files in the install tree's Tmphtml folder, searching proxy and firewall logs back to April 2026; isolate any host that matches and keep the cached files before any cleanup.
Analysis
GTIG and Mandiant report that a cluster they track as UNC7017 repeatedly altered two configuration files on AOMEI Technology's update servers between April and July 2026, each time for five to ten minutes before restoring the genuine content; GTIG confirmed three windows and says more probably went unseen (GTIG, 2026-10-16). ManageEngine's Threat Analysis Lab (METAL) writes "There was no CVE, no memory corruption, and no unpatched component." (METAL, 2026-10-16).
The client polls down_html.ini (update archive address and MD5 checksum) and Notifycfg.ini (what to display and run); during a window the actor pointed the first at an attacker-controlled ZIP with a matching checksum and padded the second with more than 35,000 lines of dummy sections, so the client started the unpacked downloader from its html directory, and GTIG describes the same flow for AnyViewer (GTIG, 2026-10-16). METAL's EDR recorded the chain on Backupper 8.3.0 (METAL, 2026-10-16).
The downloader, CROSSROAD, stops in some branches when the host geolocates to China (GTIG, 2026-10-16) and, METAL adds, when specific endpoint security agents are present (METAL, 2026-10-16). It registers a scheduled task that runs a signed Radmin binary every three hours; that binary loads an attacker-built DLL by search-order hijacking, which registers an in-process COM server running the SHINYROAD backdoor as encrypted PocketPy bytecode (GTIG, 2026-10-16). On some hosts GTIG later saw the Adaptix C2 agent, disguised as Nitro PDF tooling and started by hidden PowerShell through a second scheduled task (GTIG, 2026-10-16). The 20 July window also pointed a popup at a remote WebDAV path through an invisible window, which can leak the user's NetNTLMv2 response (GTIG, 2026-10-16).
GTIG's telemetry shows affected IT-services, telecommunications and higher-education organizations in 11 countries including Switzerland and calls the targeting opportunistic; AOMEI told Mandiant on 2026-07-29 that it had taken corrective action (GTIG, 2026-10-16). AOMEI's Backupper release notes through 8.5.0 list no change to update verification as of 2026-10-17 (AOMEI Technology, 2026-10-09).
Triage: do not validate an alert by fetching AOMEI's update address now: the files revert within minutes and the genuine content served then has led analysts to dismiss real detections; the Nitro PDF camouflage can make alerts read as isolated user downloads, so trace each one's parent process back to the updater (GTIG, 2026-10-16). Radmin is legitimate software, so provenance discriminates: METAL's EDR recorded the updater's unsigned child process installing it (METAL, 2026-10-16).
Cited evidence
Each tampering window remained active for only five to ten minutes before reverting to authentic versions.
impacted organizations spanned diverse sectors, including IT services, telecommunications, higher education and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.
Organizations running AOMEI software cannot assume they are protected solely because the vendor took corrective server-side action.
Nothing in this attack exploited a software defect. There was no CVE, no memory corruption, and no unpatched component.
As of publication, we have not independently verified that the compromise has been contained.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.