AOMEI Backupper and AnyViewer: update server tampered for minutes at a time to push CROSSROAD/SHINYROAD backdoor (no CVE)
Severity: high · Patch status: patched · Since 2026-10-15
Google Threat Intelligence Group and Mandiant, working from ManageEngine's METAL telemetry, report that an actor they track as UNC7017 altered configuration files (downhtml.ini, Notifycfg.ini) on AOMEI's update infrastructure for five to ten minutes at a time between April and July 2026, with observed windows on 2026-05-28, 2026-07-16 and 2026-07-20 (UTC). Clients checking for updates then downloaded a package that ran the CROSSROAD downloader, which installed a trojanized Radmin bundle carrying the SHINYROAD modular backdoor; a second technique on 2026-07-20 used a hidden WebDAV popup to coerce NetNTLMv2 hashes. The update flow trusted unsigned config files and an MD5 hash in the same file, so no exploit was needed. GTIG saw victims in IT services, telecoms and higher education in 11 countries. AOMEI hardened its servers on 2026-07-29, migrated the update service on 2026-08-05 and released Backupper 8.5.1 on 2026-10-19, but a server-side fix does not remove backdoors already installed, and AOMEI says its investigation is ongoing.
What to do
- Update AOMEI Backupper to 8.5.1 from aomeitech.com and run AOMEI's Security Scanner (download link and SHA-256 are on its statement page).
- Hunt April-July 2026 for scheduled tasks \RadminComponentRuntime and \NitroRuntime, an unsigned BlkScrDl.dll in %LOCALAPPDATA%\Radmin\, and unsigned children of Backupper.exe/ABNotify.exe (e.g. upgrade-now.exe under ...\AOMEI\*\html\).
- Block outbound to storage-data.com and subdomains, 8.210.84.56, 47.239.60.117 and 8.218.65.184 (TCP 41397 / 443), and block outbound SMB (445) and WebDAV to external addresses.
- On affected hosts, change the Windows or domain account passwords (a Hello PIN change is not enough) and preserve %PROGRAMFILES(X86)%\AOMEI\*\Tmphtml\ contents and proxy/firewall logs for timing correlation.
- Search proxy logs for User-Agent Anyviewer-loader/1.0.
Fixed versions
Sources
All live incidents on Threat Watch