BETWEEN April and July 2026, UNC7017 attackers tampered with AOMEI’s official update infrastructure for brief windows of five to ten minutes, delivering the CROSSROAD downloader and SHINYROAD backdoor to enterprise systems during those moments. They modified two remote configuration files, down_html.ini and Notifycfg[.]ini, by exploiting a lack of cryptographic verification for remote config files in the desktop client. Investigations note that the attackers did not rely on software flaws but on this design gap.
In one window on 16 July 2026, they even inserted more than 35,000 dummy lines into Notifycfg[.]ini to bypass local version checks and force execution of the payload.
The delivery chain began with a trojanised upgrade-now[.]zip containing a 64‑bit C downloader (CROSSROAD). After initial execution, CROSSROAD checked the victim’s external IP and ceased if it resolved to China, while for other targets it restored the legitimate configuration to conceal activity and then deleted itself.
It unpacked a legitimate Famatech Radmin 3.x utility, created a recurring task, and used a signed Radmin binary to load a malicious DLL (BlkScrDl[.]dll) that invoked SHINYROAD in memory via an embedded Python interpreter. In mid‑July, the group added the Adaptix C2 framework disguised as a Nitro PDF tool and a one‑pixel popup to steal NetNTLMv2 hashes via WebDAV.
Victims spanned IT services, telecommunications and higher education across multiple countries, with remedial action taken by AOMEI on 29 July 2026, though previously infected hosts remain at risk. Defenders are advised to inventory AOMEI Backupper and AnyViewer deployments, search for RadminComponentRuntime or NitroRuntime tasks, and block the affected domains and IPs.