Threat reportSupply ChainTL-2026-3750
UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update Infrastructure Delivers CROSSROAD, SHINYROAD and ADAPTAGENT
UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update (TL-2026-3750), also tracked as AOMEI update infrastructure compromise, is a critical-severity supply-chain compromise, first published 2026-10-16. It is attributed to UNC7017 with low confidence, affects AOMEI Technology AOMEI Backupper, maps to 21 MITRE ATT&CK techniques (T1001.001, T1027.013, T1036.005), and is covered by 9 detection rules and 35 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1UNC7017
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 35Indicators of compromise
Key facts for TL-2026-3750
- Threat ID
- TL-2026-3750
- Also known as
- AOMEI update infrastructure compromise, Ephemeral supply chain tampering
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- UNC7017
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- it-services, telecoms, higher education
- Target regions
- australia, brazil, india, pakistan, portugal, singapore, south africa, spain, switzerland, Turkiye, united states of america
- Detection rules
- 9
- Indicators of compromise
- 35
- Updates
- 2026-10-16 · revalidated 1× · latest source
Malware and tooling in UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update
Malware and tooling: ADAPTAGENT, AdaptixC2, CROSSROAD, SHINYROAD, AnyViewer, RAdmin
How UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update works
GTIG and Mandiant report that UNC7017 repeatedly tampered with AOMEI Technology update configuration files (down_html.ini, Notifycfg.ini) on origin servers for only 5-10 minute windows between April and July 2026, then reverted them to authentic versions. Clients polling during a window received the CROSSROAD downloader, which staged the SHINYROAD backdoor and ADAPTAGENT (Adaptix C2 agent); server-side remediation does not remove scheduled-task persistence from already-compromised endpoints.
Google Threat Intelligence Group (GTIG) and Mandiant, with ManageEngine's Threat Analysis Lab (METAL), describe a campaign by the uncategorized cluster UNC7017 against the update infrastructure of AOMEI Technology (AOMEI Backupper and AnyViewer). Activity ran from April to July 2026. Early CROSSROAD payloads were hosted on Alibaba Cloud OSS (serv.oss-cn-hongkong.aliyuncs.com); a CROSSROAD sample was submitted to VirusTotal on 2026-05-20. METAL identified activity across several customer environments in late May 2026. Mandiant notified AOMEI on 2026-07-17 and AOMEI confirmed corrective actions on 2026-07-29.
The actor modified two origin-hosted configuration files for only about 5-10 minutes at a time, then reverted them. down_html.ini (https://www2.aomeisoftware.com/download/abpopup/down_html.ini) normally carries the update version, an MD5 and the URL of upgrade-now.zip; the actor pointed the URL at attacker infrastructure and changed the version and MD5 values. Notifycfg.ini (https://account.aomeitech.com/Notifycfg.ini) controls notification content and command execution; on 2026-07-16 it was padded with more than 35,000 repetitive [dummy_XXXXXX] sections that forced an update trigger and immediate execution of the dropper. Observed windows were 2026-05-28 05:40-05:50 UTC (10 min), 2026-07-16 08:33-08:39 UTC (6 min) and 2026-07-20 10:35-10:40 UTC (5 min). Because the files were restored, live URL checks after the fact look clean; responders must rely on cached .ini files (e.g. %PROGRAMFILES(X86)%\AOMEI\*\Tmphtml\), proxy logs and retrospective endpoint hunts.
CROSSROAD (upgrade-now.exe, PE metadata typo 'AOMEI Update Compent') is the first-stage downloader. It checks that its path contains 'AOMEI', takes a mutex Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}, resolves its external IP through DNS/HTTP reflection services (myip.opendns.com, o-o.myaddr.l.google.com, checkip.amazonaws.com, api.ipify.org, ifconfig.me/ip, icanhazip.com) using the User-Agents Anyviewer-loader/1.0 and Anyviewer-ipcheck/1.0, and aborts the primary payload if the country code is CN. It reverts down_html.ini to the legitimate values, downloads component.zip from promotion.storage-data.com to %TEMP%\svc<hex>.tmp, extracts it to %LOCALAPPDATA%\Radmin\ with an embedded miniz library, and registers the scheduled task \RadminComponentRuntime (every 3 hours, FamItrfc.exe --runtimechk). It self-deletes through a --nitrod child process that renames the :$DATA stream to :wtfbbq and sets delete-on-close. ManageEngine also observed the chain Backupper.exe -> ABNotify.exe -> upgrade-now.exe -> rsetup64.exe installing Radmin Server.
SHINYROAD is a multi-component backdoor built around a legitimate signed Radmin binary. FamItrfc.exe side-loads the unsigned BlkScrDl.dll, which maps config.zip into shared memory (Local\963d3c60-d406-4ad6-aa1e-dc8e45061ccf) and registers an in-process COM server (CLSID {21191641-0D7F-4CD9-9572-01AAE6E7851B}, AppID {9AD3E98A-4C7E-4F37-982D-D73D41E4F91B}) pointing to csvc\RuntimeComponent.dll. When Radmin instantiates the CLSID, RuntimeComponent.dll (hosted by dllhost.exe) decrypts metadata.dat (ChaCha20, HMAC-SHA256 key derivation) into compiled Python bytecode run by an embedded PocketPy interpreter with custom modules _pyio_compat, _pyio_struct and pkpy. The backdoor speaks a custom binary protocol (handshake 'mct3-handshake-v1'), derives an agent ID from hostname and username, switches to symmetric encryption, offers an interactive shell via os.system, sends randomized junk packets to disrupt network signatures, and loads extensions in memory through a WorkPool. Observed C2 is 8.218.65.184 on TCP 443 and 41397.
ADAPTAGENT is an Adaptix C2 post-exploitation agent disguised as Nitro PDF software: NitroPromotion.exe launches the side-loaded Eztwain4.dll, persists via the scheduled task \NitroRuntime (hidden PowerShell Start-Process of %TEMP%\NitroPromotion.exe) and beacons every 2 minutes to 8.210.84.56:6800. On 2026-07-20 the actor also set a 1x1, priority-9999 PopWindow entry in Notifycfg.ini whose address was file://8.210.84.56/DavWWWRoot/campaign/24hour-flash-sale.html, making the AOMEI client attempt a WebDAV/UNC connection and leak NetNTLMv2 authentication to the attacker. The July 20 wave also split delivery: the first download came from Google Cloud Storage (storage.googleapis.com/aomeiupdate/) to avoid proxies that block newly registered domains, with later payloads from storage-data.com. A whitelist.ini hosted on the actor's server (96.126.191.98 configured 2026-06-22) is consulted by the loader to decide which hosts receive payloads.
Victims identified by GTIG/Mandiant are in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkiye and the United States; targeting appears opportunistic (any client polling during a window). The source attributes activity only to the UNC7017 cluster; no nation-state attribution is made, and no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-3750
Command and Control
T1001.001 Junk Data; T1105 Ingress Tool Transfer; T1219.002 Remote Desktop Software; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography
Defense Evasion
T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1480 Execution Guardrails; T1564.004 NTFS File Attributes; T1574.001 DLL
Persistence
Execution
T1059.001 PowerShell; T1059.006 Python; T1559.001 Component Object Model
Credential Access
Initial Access
T1195.002 Compromise Software Supply Chain
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1608.001 Upload Malware
Discovery
Affected products and versions in UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update
- AOMEI Technology — AOMEI Backupper
Vulnerable versions: Update clients polling down_html.ini / Notifycfg.ini during tampering windows (8.2.x referenced by GTIG; ManageEngine cites v8.3.0 and later)
Fixed in: Vendor reported corrective actions on 2026-07-29 (server-side); no fixed client version published - AOMEI Technology — AnyViewer
Vulnerable versions: Clients polling update configuration during tampering windows
Fixed in: Vendor reported corrective actions on 2026-07-29 (server-side); no fixed client version published
Remediation for UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update
Patches
- AOMEI Technology reported corrective actions on 2026-07-29; no CVE or patch identifier was published in the source
Immediate actions
- Hunt for scheduled tasks \RadminComponentRuntime and \NitroRuntime and remove them from affected endpoints
- Remove %LOCALAPPDATA%\Radmin\ malicious components (BlkScrDl.dll, csvc\RuntimeComponent.dll, config.zip, metadata.dat) and %LOCALAPPDATA%\Nitro Pro\ NitroPromotion.exe and Eztwain4.dll
- Block outbound traffic to storage-data.com, promotion.storage-data.com, aomei.storage-data.com, 8.210.84.56, 8.218.65.184 and 47.239.60.117
- Block outbound SMB and WebDAV to external IPs and reset credentials of users on hosts that polled AOMEI update servers during tampering windows (NetNTLMv2 exposure)
- Preserve cached .ini files in AOMEI Tmphtml/html directories, proxy and firewall logs for retrospective hunting across April-July 2026
Workarounds
- Disable or restrict automatic update and notification polling (Backupper.exe, ABNotify.exe) for AOMEI Backupper and AnyViewer until endpoint hunting is complete
Longer-term hardening
- Alert on unsigned DLLs loaded by Radmin FamItrfc.exe and on processes launched with --runtimechk or --nitrod
- Alert on hidden PowerShell Start-Process launching executables from %TEMP% and on dllhost.exe COM servers loading RuntimeComponent.dll
- Do not rely on live validation of update URLs because tampering lasted only 5-10 minutes; use historical telemetry
- Vendor-side: sign remote configuration files, verify Authenticode signatures on downloaded archives, pin update domains, disallow file:// and UNC schemes in embedded web views, and enable file integrity monitoring and MFA on origin servers
Weaknesses (CWE) in UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update
Timeline of UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update
- April 2026 (month-level): UNC7017 begins ephemeral tampering of AOMEI update configuration; early CROSSROAD payloads hosted on Alibaba Cloud OSS (serv.oss-cn-hongkong.aliyuncs.com)
- CROSSROAD upgrade-now.zip/upgrade-now.exe submitted to VirusTotal
- First documented tampering window, 05:40-05:50 UTC (10 minutes); ManageEngine METAL detects the activity across multiple customer environments in late May
- A customer reports suspicious activity to ManageEngine, which escalates to AOMEI.
- Allowlist IP 96.126.191.98 configured in whitelist.ini on the actor's infrastructure
- July 1-7: actor shifts from cloud storage to dedicated vendor-themed domains under storage-data.com
- Second tampering window, 08:33-08:39 UTC (6 minutes); down_html.ini redirected to promotion.storage-data.com and Notifycfg.ini padded with over 35,000 dummy sections to force execution
- Mandiant notifies AOMEI Technology
- Third tampering window, 10:35-10:40 UTC (5 minutes); first-stage download via Google Cloud Storage and WebDAV/UNC NTLM coercion toward 8.210.84.56 added
- AOMEI Technology confirms corrective actions; compromised endpoints retain scheduled-task persistence
- AOMEI Backupper 8.5.0 released; changelog documents no update-verification changes, so the unsigned update-config weakness is not documented as fixed.
- GTIG and Mandiant publish 'Investigating Ephemeral Supply Chain Tampering' with IOCs and YARA rules
- ManageEngine METAL publishes its AOMEI Backupper supply chain compromise analysis
Update history for TL-2026-3750
- 2026-10-16 — AOMEI Backupper Update Server Tampering Delivers CROSSROAD/SHINYROAD Backdoor (UNC7017): What changed No field escalation. The newer report rates severity HIGH versus the existing CRITICAL; that would be a downgrade and is ignored. Exploitability ACTIVE and status ACTIVE are unchanged. New indicators (5) 5 new host-based/behavi
Sources cited for UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update
- Investigating Ephemeral Supply Chain Tampering (GTIG / Mandiant)
- AOMEI Backupper Supply Chain Compromise (ManageEngine METAL)
- Google Threat Intelligence IOC collection for UNC7017 AOMEI campaign
- Mitigation Guidance for Supply Chain Compromise (Google Cloud)
- 3CX Software Supply Chain Compromise (Mandiant)
- Evasive Attacker Leverages SolarWinds Supply Chain Compromises with SUNBURST Backdoor (Mandiant)
Detection coverage for TL-2026-3750
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3750 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.