Google Threat Intelligence Group (GTIG) and Mandiant said on Oct 15 that a threat cluster they track as UNC7017 compromised the update infrastructure of AOMEI Technology, the maker of the AOMEI Backupper backup tool and the AnyViewer remote-desktop tool, between April and July 2026. ManageEngine’s Threat Analysis Lab, part of Zoho, first caught it in its EDR telemetry in late May. GTIG names no country or known actor behind UNC7017.
How it worked. Backupper’s background services poll two text files on AOMEI’s servers over HTTPS. One, down_html.ini, names the update package and the MD5 hash it should match. The other, Notifycfg.ini, tells the notification service what to show and what local program to run. Neither file is signed, and the hash sits inside the same unsigned file as the URL. UNC7017 swapped both files for a few minutes, pointing clients at its own upgrade-now.zip and telling the notifier to run it, then put the genuine files back. No software bug was exploited. Confirmed windows: May 28 (10 minutes), July 16 (6 minutes) and July 20 (5 minutes), all UTC. GTIG says more windows probably happened that it didn’t see.
What landed. A downloader GTIG calls CROSSROAD checked the machine’s external IP, stopped its main payload path for China in some branches, staged a signed Radmin bundle under %LOCALAPPDATA%\Radmin, set a scheduled task to run every three hours, reset the local update file to look clean, and deleted itself. The signed Radmin binary then side-loads an attacker DLL that runs the SHINYROAD backdoor inside an embedded Python interpreter. From mid-July, some hosts also got an Adaptix C2 agent dressed up as Nitro PDF. On July 20 the attacker added a 1x1-pixel pop-up pointing at a WebDAV share, which can leak a user’s NetNTLMv2 response with nothing executed at all.
Who got hit. GTIG saw affected organizations in IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. Targeting was opportunistic: anything that polled during a window. Victim count: Undisclosed. Mandiant told AOMEI on July 17, and AOMEI said on July 29 that it had taken corrective action on its servers. How the attacker got write access to those servers: Undisclosed.
Why a security team should care. This is the cheap version of a SolarWinds or 3CX. Nothing malicious ever sat in a release build, so binary analysis of the shipped product finds nothing, and anyone checking the vendor’s URL after an alert sees clean files. GTIG says analysts have been closing real detections as false positives for exactly that reason. And any desktop tool that pulls unsigned config from the internet and lets it trigger local execution has the same shape, whether or not it’s AOMEI.
What we’d check. Inventory AOMEI Backupper and AnyViewer installs, including on IT staff and MSP jump boxes. Hunt the full April-to-July range for the \RadminComponentRuntime and \NitroRuntime scheduled tasks, unsigned BlkScrDl.dll or Eztwain4.dll, and FamItrfc.exe --runtimechk runs. Block storage-data[.]com and its subdomains plus 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117, and block outbound SMB (TCP 445) and WebDAV to external addresses. Then alert on unsigned child processes spawned by any updater, not just this one. GTIG published YARA rules and ManageEngine published Sigma rules.