Affected Systems

AOMEI Backupper (Windows backup software), at least version 8.3.0 confirmed affected. All installations that checked for updates during three confirmed tampering windows between May 28 and July 20, 2026 (total ~21 minutes across three incidents). AOMEI AnyViewer uses the same insecure update mechanism but no confirmed infections reported. Organizations affected across 11 countries in IT services, telecom, and higher education sectors.

Exploitation Status

Active supply chain compromise confirmed. Three tampering windows documented: May 28 (10 min), July 16 (6 min), and July 20 (5 min), 2026. AOMEI reports servers fixed, but backdoor (SHINYROAD implant) persists on already-compromised machines. Attacker group tracked as UNC7017 by Google Threat Intelligence Group. Additional tampering windows likely occurred but undetected.

Business Impact

Machines that updated during tampering windows received CROSSROAD downloader, which installed SHINYROAD backdoor providing remote shell and code execution. Backdoor runs with AOMEI service privileges (often SYSTEM-level). July 20 attack also harvested NetNTLMv2 credentials via invisible WebDAV pop-up, affecting even machines where backdoor execution was blocked. Attack bypassed traditional detection due to 5-10 minute windows and lack of cryptographic verification in AOMEI's update process. No CVE assigned as this was server compromise, not software vulnerability.

Urgency

🔴 Immediate

Recommended Actions

  • Hunt for SHINYROAD indicators: scheduled tasks running Radmin every 3 hours, unsigned DLLs in Radmin folders, outbound connections to hard-coded C2 addresses, and Adaptix C2 framework disguised as Nitro PDF
  • Search endpoint logs for AOMEI Backupper update activity on May 28 (05:40-05:50 UTC), July 16 (08:33-08:39 UTC), and July 20 (10:35-10:40 UTC) 2026
  • Block known C2 infrastructure at network perimeter and review NetNTLMv2 authentication logs for credential harvesting attempts via WebDAV on July 20
  • Isolate and reimage any systems with confirmed CROSSROAD/SHINYROAD presence; server fix does not remove backdoor from infected endpoints
  • Evaluate removal or replacement of AOMEI Backupper and AnyViewer due to insecure update mechanism lacking cryptographic signature verification