# UNC7017 Ephemeral Supply Chain Tampering of AOMEI Update Infrastructure Delivers CROSSROAD, SHINYROAD and ADAPTAGENT

> GTIG and Mandiant report that UNC7017 repeatedly tampered with AOMEI Technology update configuration files (down_html.ini, Notifycfg.ini) on origin servers for only 5-10 minute windows between April and July 2026, then reverted them to authentic versions. Clients polling during a window received the CROSSROAD downloader, which staged the SHINYROAD backdoor and ADAPTAGENT (Adaptix C2 agent); server-side remediation does not remove scheduled-task persistence from already-compromised endpoints.

- **Published:** 2026-10-16T14:46:52Z
- **Last reviewed:** 2026-10-16T17:57:34.322Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3750
- **ID:** TL-2026-3750
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** UNC7017
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Google Threat Intelligence Group (GTIG) and Mandiant, with ManageEngine's Threat Analysis Lab (METAL), describe a campaign by the uncategorized cluster UNC7017 against the update infrastructure of AOMEI Technology (AOMEI Backupper and AnyViewer). Activity ran from April to July 2026. Early CROSSROAD payloads were hosted on Alibaba Cloud OSS (serv.oss-cn-hongkong.aliyuncs.com); a CROSSROAD sample was submitted to VirusTotal on 2026-05-20. METAL identified activity across several customer environments in late May 2026. Mandiant notified AOMEI on 2026-07-17 and AOMEI confirmed corrective actions on 2026-07-29.

The actor modified two origin-hosted configuration files for only about 5-10 minutes at a time, then reverted them. down_html.ini (https://www2.aomeisoftware.com/download/abpopup/down_html.ini) normally carries the update version, an MD5 and the URL of upgrade-now.zip; the actor pointed the URL at attacker infrastructure and changed the version and MD5 values. Notifycfg.ini (https://account.aomeitech.com/Notifycfg.ini) controls notification content and command execution; on 2026-07-16 it was padded with more than 35,000 repetitive [dummy_XXXXXX] sections that forced an update trigger and immediate execution of the dropper. Observed windows were 2026-05-28 05:40-05:50 UTC (10 min), 2026-07-16 08:33-08:39 UTC (6 min) and 2026-07-20 10:35-10:40 UTC (5 min). Because the files were restored, live URL checks after the fact look clean; responders must rely on cached .ini files (e.g. %PROGRAMFILES(X86)%\AOMEI\*\Tmphtml\), proxy logs and retrospective endpoint hunts.

CROSSROAD (upgrade-now.exe, PE metadata typo 'AOMEI Update Compent') is the first-stage downloader. It checks that its path contains 'AOMEI', takes a mutex Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}, resolves its external IP through DNS/HTTP reflection services (myip.opendns.com, o-o.myaddr.l.google.com, checkip.amazonaws.com, api.ipify.org, ifconfig.me/ip, icanhazip.com) using the User-Agents Anyviewer-loader/1.0 and Anyviewer-ipcheck/1.0, and aborts the primary payload if the country code is CN. It reverts down_html.ini to the legitimate values, downloads component.zip from promotion.storage-data.com to %TEMP%\svc<hex>.tmp, extracts it to %LOCALAPPDATA%\Radmin\ with an embedded miniz library, and registers the scheduled task \RadminComponentRuntime (every 3 hours, FamItrfc.exe --runtimechk). It self-deletes through a --nitrod child process that renames the :$DATA stream to :wtfbbq and sets delete-on-close. ManageEngine also observed the chain Backupper.exe -> ABNotify.exe -> upgrade-now.exe -> rsetup64.exe installing Radmin Server.

SHINYROAD is a multi-component backdoor built around a legitimate signed Radmin binary. FamItrfc.exe side-loads the unsigned BlkScrDl.dll, which maps config.zip into shared memory (Local\963d3c60-d406-4ad6-aa1e-dc8e45061ccf) and registers an in-process COM server (CLSID {21191641-0D7F-4CD9-9572-01AAE6E7851B}, AppID {9AD3E98A-4C7E-4F37-982D-D73D41E4F91B}) pointing to csvc\RuntimeComponent.dll. When Radmin instantiates the CLSID, RuntimeComponent.dll (hosted by dllhost.exe) decrypts metadata.dat (ChaCha20, HMAC-SHA256 key derivation) into compiled Python bytecode run by an embedded PocketPy interpreter with custom modules _pyio_compat, _pyio_struct and pkpy. The backdoor speaks a custom binary protocol (handshake 'mct3-handshake-v1'), derives an agent ID from hostname and username, switches to symmetric encryption, offers an interactive shell via os.system, sends randomized junk packets to disrupt network signatures, and loads extensions in memory through a WorkPool. Observed C2 is 8.218.65.184 on TCP 443 and 41397.

ADAPTAGENT is an Adaptix C2 post-exploitation agent disguised as Nitro PDF software: NitroPromotion.exe launches the side-loaded Eztwain4.dll, persists via the scheduled task \NitroRuntime (hidden PowerShell Start-Process of %TEMP%\NitroPromotion.exe) and beacons every 2 minutes to 8.210.84.56:6800. On 2026-07-20 the actor also set a 1x1, priority-9999 PopWindow entry in Notifycfg.ini whose address was file://8.210.84.56/DavWWWRoot/campaign/24hour-flash-sale.html, making the AOMEI client attempt a WebDAV/UNC connection and leak NetNTLMv2 authentication to the attacker. The July 20 wave also split delivery: the first download came from Google Cloud Storage (storage.googleapis.com/aomeiupdate/) to avoid proxies that block newly registered domains, with later payloads from storage-data.com. A whitelist.ini hosted on the actor's server (96.126.191.98 configured 2026-06-22) is consulted by the loader to decide which hosts receive payloads.

Victims identified by GTIG/Mandiant are in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkiye and the United States; targeting appears opportunistic (any client polling during a window). The source attributes activity only to the UNC7017 cluster; no nation-state attribution is made, and no CVE or CVSS applies.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1059.001 PowerShell
- T1059.006 Python
- T1559.001 Component Object Model
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1480 Execution Guardrails
- T1036.005 Match Legitimate Resource Name or Location
- T1027.013 Encrypted/Encoded File
- T1070.004 File Deletion
- T1564.004 NTFS File Attributes
- T1187 Forced Authentication
- T1614 System Location Discovery
- T1571 Non-Standard Port
- T1573.001 Symmetric Cryptography
- T1001.001 Junk Data
- T1219.002 Remote Desktop Software
- T1105 Ingress Tool Transfer

## Sources

- [Investigating Ephemeral Supply Chain Tampering (GTIG / Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/)
- [AOMEI Backupper Supply Chain Compromise (ManageEngine METAL)](https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html)
- [Google Threat Intelligence IOC collection for UNC7017 AOMEI campaign](https://www.virustotal.com/gui/collection/dcba624e1f934c2dc047f12161f51397b1603610f7d7a15069c38f0c5bd9e09f)
- [Mitigation Guidance for Supply Chain Compromise (Google Cloud)](https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise)
- [3CX Software Supply Chain Compromise (Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise)
- [Evasive Attacker Leverages SolarWinds Supply Chain Compromises with SUNBURST Backdoor (Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3750