Back cloud.google.com

Google Threat Intelligence Group, Mandiant

cloud.google.com • October 16, 2026

Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst configuration tampering against AOMEI origin servers. Each tampering window remained active for only five to ten minutes before reverting to authentic versions. This is the first time that we have encountered a software supply chain compromise that was implemented with these very short windows, effectively evading traditional point-in-time triage and automated file scanning.

The campaign delivered a multi-stage payload chain involving the newly tracked CROSSROAD downloader and SHINYROAD backdoor. The threat actor iteratively modified its tradecraft, pivoting its staging infrastructure from cloud providers to dedicated domains and legitimate cloud storage. This evolving staging setup makes it particularly challenging for defenders to establish effective infrastructure-based blocking or network controls. We attribute this activity to a threat cluster we are tracking as UNC7017.

Based on available telemetry, impacted organizations spanned diverse sectors, including IT services, telecommunications, higher education and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. That said, because the campaign attempted to deliver malware to any system polling the update distribution servers during the threat actor’s tampering windows, victimology was opportunistic and likely extends more broadly than the organizations we directly identified.

This campaign was initially identified through collaborative research with the ManageEngine Threat Analysis Lab (METAL), part of Zoho Corporation, whose endpoint detection and response (EDR) telemetry first detected the activity in late May across multiple customer environments. We thank the METAL team for their proactive telemetry sharing and ongoing collaboration to help secure our mutual customer bases and the broader software ecosystem. Following this joint effort, GTIG notified potentially affected organizations and shared technical findings with AOMEI Technology. AOMEI reported that they took corrective action to secure their distribution servers. METAL’s analysis of this campaign is available in their blog .

How AOMEI Update and Notification Systems Work

AOMEI Backupper provides data backup, disk cloning, and disaster recovery, while AnyViewer facilitates remote desktop access and support. Users of these products rely on the ABMarket update flow and its associated background services ( Backupper.exe and ABNotify.exe ) that periodically poll remote endpoints over HTTPS for update notifications and promotional pop ups:

Figure 1: AOMEI Update Mechanism

Update Configuration ( down_html.ini ): The software periodically sends an HTTPS request to . This file contains the version number, the MD5 hash of the expected update package, and the URL where the client should download upgrade-now.zip .

Notification Configuration ( Notifycfg.ini ): The software contacts . This file instructs the local notification process ( ABNotify.exe ) what messages to display and specifies commands or programs located in the software’s local directory to execute.

Under normal conditions, these files direct the client to download official files hosted on AOMEI’s own domain ( www2.aomeisoftware.com ).

Rather than maintaining a persistent, static modification on the vendor’s distribution servers, GTIG and METAL’s telemetry indicates UNC7017 conducted repeated, short-burst configuration tampering. We confirmed several tampering windows in 2026, alongside related malware samples observed in the wild starting in late April. However, given the short duration of these windows, it is probable that additional tampering occurred throughout the campaign that remained outside our visibility. Systems checking for updates during an active window received malicious instructions, while systems checking before or after received clean, authentic files.

During the brief tampering windows, the threat actor modified the update settings file on the update server to redirect the software to download a malicious ZIP package from attacker-controlled servers instead of legitimate updates. The threat actor also altered the notification settings file on the update server to abuse the software’s automatic notification service, forcing the system to immediately execute the downloaded malware locally. If a user’s application checked for updates while the threat actor’s modifications were active, then the application would download the trojanized update and execute malware.

In cases where altered configuration files were active, the threat actor directed clients to download a weaponized ZIP archive containing CROSSROAD, an initial downloader responsible for environment validation and staging secondary components. CROSSROAD subsequently established scheduled task persistence to deploy SHINYROAD, a modular backdoor framework delivered via trojanized administration utilities to facilitate covert command and control.

Short Burst Supply Chain Tampering

A defining characteristic of UNC7017's operational security is its reliance on ephemeral, time-compressed server modifications. Across all directly observed waves, the adversary avoided leaving malicious configurations resident on AOMEI's update servers:

May 28: 10-minute exposure window (05:40 – 05:50 UTC)

July 16: 6-minute exposure window (08:33 – 08:39 UTC)

July 20: 5-minute exposure window (10:35 – 10:40 UTC)

At the conclusion of each window, UNC7017 reverted both down_html.ini and Notifycfg.ini to their legitimate contents. This hinders post-incident vendor audits, minimizes the window for network defenders to capture live malicious server responses, and restricts compromise to clients polling for updates during those exact minutes.

Weaponizing Native Update Logic: down_html.ini and Configuration Bloat

To compromise endpoints without relying on software vulnerabilities, UNC7017 abused the AOMEI client's legitimate update and popup rendering workflow. By default, the client downloads update archives into its Tmphtml directory, unpacks them to the local html/ directory, and processes instructions from two remote configuration files: down_html.ini and Notifycfg.ini.

To ensure the AOMEI client accepted and extracted the weaponized upgrade-now.zip archive, UNC7017 systematically incremented the minor build version (“thrid”) and updated the expected MD5 checksum in down_html.ini during each tampering window:

Figure 2: July 16 tampering of down_html.ini redirecting downloads to promotion.storage-data.com with incremented version (thrid=6) and synchronized MD5 hash.

During the 6-minute window on July 16, UNC7017 simultaneously modified Notifycfg.ini (SHA256: d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934), injecting over 35,000 lines of repetitive configuration sections named [dummy_XXXXXX]. This extreme configuration bloat was structured to override standard client version checks forcing the client to trigger an update regardless of its installed version and immediately execute the unpacked CROSSROAD dropper (upgrade-now.exe) from the local html/ directory.

Infrastructure Shifts

Between April an July 2026, UNC7017 shifted its staging and delivery infrastructure between public cloud buckets and actor controlled lookalike domains, likely to test payload delivery and masquerade as legitimate vendor traffic.

Infrastructure Shifts

Early Cloud Staging (April–May 2026): Early CROSSROAD payloads ( upgrade-now.exe observed May 20) relied on Alibaba Cloud Object Storage ( serv.oss-cn-hongkong.aliyuncs.com ).

Dedicated Domain Infrastructure (July 1–7, 2026): The threat actor transitioned to dedicated, vendor-themed domains ( storage-data.com , promotion.storage-data.com , aomei.storage-data.com ).

Hybrid Cloud Delivery Split (July 20, 2026): During the 5-minute window on July 20, the threat actor modified down_html.ini to direct initial client downloads to a public Google Cloud Storage bucket ( storage.googleapis.com/aomeiupdate/upgrade-now.zip ) rather than storage-data.com . This tactical shift allowed the initial download to bypass enterprise proxy filters that block Newly Registered Domains (NRDs), while the executed CROSSROAD loader continued to leverage storage-data.com for secondary payload retrieval and C2 communications.

Figure 3: July 20 modification of down_html.ini utilizing Google Cloud Storage (thrid=7) to evade Newly Registered Domain (NRD) perimeter blocks.

WebDAV NTLM Credential Coercion

On July 20, UNC7017 introduced a secondary exploitation vector inside Notifycfg.ini. Prior to tampering, Notifycfg.ini displayed a legitimate 400x380 promotional banner advertising "World Cup Deals." The threat actor replaced this banner with an invisible 1x1 pixel window (Width=1, Height=1) assigned maximum execution priority (Priority=9999) that instructed the client to render a remote HTML file over a universal naming convention (UNC) WebDAV path:

Figure 4: Malicious Notifycfg.ini configuration from July 20 implementing an invisible 1x1 popup window to coerce WebDAV/NTLM authentication to 8.210.84.56 .

Malware Delivery & Post-Exploitation Tooling

Across the campaign waves, UNC7017 deployed a consistent chain of custom loaders and commercial/open-source post-exploitation frameworks:

Defense Evasion via Timestomping: Analysis of an early CROSSROAD dropper (upgrade-now.exe) submitted to VirusTotal on May 20 revealed that the threat actor manipulated PE compilation timestamps to display fabricated 2024 build dates in an effort to complicate forensic timeline analysis.

Modified Radmin Server Backdoor: During the May 28 wave, the unsigned loader dropped into the html/ directory executed rsetup64.exe /intsetup, silently installing a modified version of the commercial remote administration tool Radmin Server to establish persistent remote access.

Adaptix C2 Integration: Since at least early July 2026, the threat actor was observed deploying the Adaptix C2 framework across its storage-data.com infrastructure.

The Primary Downloader: CROSSROAD

The primary Stage-2 downloader ( upgrade-now.exe , SHA256: 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 ) is a 64-bit Windows executable written in C, tracked by GTIG as the CROSSROAD malware family. Delivered inside upgrade-now.zip , CROSSROAD is responsible for environment validation, active endpoint cleanup, staging the secondary payload bundle, and establishing scheduled task persistence for the Stage-3 backdoor suite.

Path Verification: As part of its configuration routine, CROSSROAD checks whether its file path contains the substring AOMEI . If the substring is absent, it initiates a self-deletion routine; however, it does not abort, continuing both its background configuration cleanup and its downloader routines regardless.

Execution Guardrails: Before proceeding with secondary downloads, CROSSROAD enforces two primary checks:

Geolocation Check: Queries external domain name system (DNS) ( myip.opendns.com , o-o.myaddr.l.google.com ) and HTTP reflection services ( checkip.amazonaws.com , api.ipify.org , ifconfig.me/ip , icanhazip.com ) using custom User-Agents ( Anyviewer-loader/1.0 , Anyviewer-ipcheck/1.0 ). In specific execution branches, if the returned country code is "CN" (China), the loader aborts its primary payload execution path.

Lock Mutex: Acquires the named mutex Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883} to prevent multiple concurrent instances on the same host.

Host Artifact Reversion & Anti-Forensics: To complicate post-incident triage and forensic reconstruction, the loader systematically reverts local configuration states during its execution cycle. The malware parses down_html.ini (located at \..\..\ ), restoring the update thread parameter ( thrid ) to its default value of 5 and pointing the update download URL back to legitimate AOMEI distribution infrastructure ( ).

Stage-3 Payload Staging & Extraction: If environment checks pass, CROSSROAD downloads (also observed as en.zip), to %TEMP%\svc .tmp, and unpacks its contents into the user’s local application data directory using an embedded miniz library.

Persistence via Scheduled Task: To ensure continuous execution of the staged payload bundle, upgrade-now.exe registers a persistent scheduled task named RadminComponentRuntime (configured with the description”Radmin Component runtime checkable.”). The task is set to execute %LOCALAPPDATA%\Radmin\FamItrfc.exe --runtimechk every three hours.

Self-Deletion ( --nitrod ): After extracting the payload bundle and creating the scheduled task, CROSSROAD purges itself from disk. To bypass Windows file-locking constraints, the executable drops a copy of itself to the temporary directory and executes it with the --nitrod parameter, passing its parent PID via NITRODP and original executable path via NITRODT . The child process waits for the parent to terminate, renames the original binary's primary :$DATA stream to an alternate data stream named :wtfbbq via SetFileInformationByHandle , and flags FileDispositionInfo with DeleteFile = TRUE to unlink the binary on handle close.

Version Information: The executable contained standard PE version metadata with a notable typo string: "ProductName: AOMEI Update Compent" .

Figure 5: Victim Profiling, Malware Delivery Logic

Stage-3 Payload: SHINYROAD and Radmin Suite

The payload archive unpacked into %LOCALAPPDATA%\Radmin\ by CROSSROAD contains a Famatech Radmin 3.x administration bundle used to deliver the SHINYROAD modular backdoor framework. The malware contains no native persistence mechanism of its own and relies entirely on the external scheduled task registered by CROSSROAD for execution.

Execution via DLL -Order Hijacking ( BlkScrDl.dll ): Execution begins when the persistent RadminComponentRuntime scheduled task launches the legitimate, signed Radmin binary %LOCALAPPDATA%\Radmin\FamItrfc.exe --runtimechk (or FamItrf2.exe ). During startup, the Radmin executable is hijacked into loading the attacker's unsigned DLL, BlkScrDl.dll , via -order hijacking. The adversary named this DLL to masquerade as Radmin's legitimate "blank screen" driver library.

Shared Memory & In-Process COM Server Staging: Upon execution, BlkScrDl.dll locates config.zip in its execution directory, maps its raw contents into a shared memory section named Local\963d3c60-d406-4ad6-aa1e-dc8e45061ccf , and dynamically registers csvc\RuntimeComponent.dll as an in-process COM Server under CLSID {21191641-0D7F-4CD9-9572-01AAE6E7851B} and AppID {9AD3E98A-4C7E-4F37-982D-D73D41E4F91B} .

COM-Triggered Stage-2 Initialization & Embedded PocketPy VM: When the Radmin process instantiates the registered CLSID, the Windows COM subsystem loads the DLL. The DLL reads config.zip directly from shared memory, extracts the encrypted payload metadata.dat , and decrypts it using ChaCha20 with an HMAC-SHA256 derived key and IV. The decrypted payload consists of compiled Python bytecode, which RuntimeComponent.dll executes within an embedded PocketPy interpreter, establishing initial C2 connectivity to 8.218.65.184:443 .

Evolution of the SHINYROAD Architecture

Analysis of earlier campaign variants revealed that SHINYROAD relies on custom C-level extensions (_pyio_compat, _pyio_struct, and pkpy) to avoid loading standard Python libraries on disk:

Custom Binary C2 Protocol : Earlier variants communicated over raw TCP ( 8.218.65.184:41397 ). The agent generates a unique ID by fingerprinting the hostname and username, authenticates via a hard-coded handshake key, and dynamically transitions all subsequent communication to use symmetric encryption derived from this unique ID.

In-Memory Capabilities : The engine supports interactive remote shell access (os.system), traffic chaffing (generating randomized junk packets to disrupt network signatures), and dynamic in-memory extension via the pkpy WorkPool thread manager without writing script modules to disk.

Post-Exploitation: Nitro PDF Theme & Adaptix C2

In mid-July 2026, following the successful deployment of SHINYROAD, telemetry identified later-stage activity where UNC7017 pushed down ADAPTAGENT, the client portion of the Adaptix C2 post-exploitation framework. To blend in or appear as user-downloaded activity, these payloads masqueraded as Nitro PDF promotional and scanning tools ( NitroPromotion.exe ):

Persistence: The malware installed a scheduled task named \NitroRuntime that executed:

Figure 6: NitroRuntime scheduled task persistence

Adaptix C2 Beaconing : The executable sideloaded Eztwain4.dll (ADAPTAGENT) from %LOCALAPPDATA%\Nitro Pro\ , which established periodic 2-minute beacons to 8.210.84.56:6800 .

Outlook and Implications

This campaign highlights a broader evolution in software supply chain attack methodologies. Supply chain intrusions have historically focused on inserting backdoors into software source code or tampering with developer build pipelines (e.g., SolarWinds , 3CX ). While highly impactful, compromised source trees leave persistent binary signatures in official release files that can be discovered during post-release binary analysis.

UNC7017's use of ephemeral configuration tampering represents a lower-overhead, higher-stealth alternative:

Anti-Analysis by Design: By restricting configuration changes to five to ten minute windows, the vast majority of legitimate users and automated repository crawlers only encounter authentic, vendor-signed files.

Selective Exploitation : Threat actors can selectively compromise target organizations that maintain frequent polling intervals while minimizing their exposure window on vendor infrastructure.

Dual-Pronged Approach : Combining software update redirection with invisible WebDAV NTLM coercion could allow adversaries to harvest credentials from passive users even if binary payload execution is blocked.

Co-opting Commercial Software : Deploying unmodified versions of legitimate administration tools (such as Radmin 3.x) to masquerade sideloaded covert channels illustrates how adversaries blend commercial remote management capabilities with hidden backdoor modules.

Remediation and Hardening

Defenders should focus on behavioral profiling of updater processes, specifically monitoring for unsigned child processes spawned by background update runners and unauthorized network redirection originating from trusted desktop software. For broader recommendations on securing software delivery pipelines, please refer to our previously published Mitigation Guidance for Supply Chain Compromise .

Vendor Notification & Architecture Hardening

On July 17, 2026, Mandiant notified AOMEI Technology regarding the observed configuration tampering on their update infrastructure and provided relevant indicators. AOMEI subsequently responded on July 29, 2026, stating that corrective actions had been taken.

Why Server-Side Remediation Does Not Disinfect Endpoints

Crucially, server-side remediation does not clean endpoints that downloaded malicious updates during earlier tampering windows. Because the tampering occurred in brief, short bursts, systems that received these files may remain compromised without the organization's knowledge unless proactive endpoint hunting and remediation are performed.

Persistent Resident Payloads : Endpoints that polled for updates during an active tampering window downloaded and staged persistent payloads (via scheduled tasks) that remain fully operational even after the vendor restores authentic .ini files on the origin servers.

Obscured Root Cause : While the subsequent backdoor activity and scheduled tasks generate detectable endpoint telemetry, the ephemeral delivery vector obscures the initial intrusion mechanism. Because server tampering lasted approximately 5 minutes—and the loader actively reverted local configuration files—investigators reviewing vendor update URLs hours later will observe only benign, authentic infrastructure, complicating root cause analysis and patient-zero identification.

Hunting Imperative : Organizations running AOMEI software cannot assume they are protected solely because the vendor took corrective server-side action. Enterprise security teams must perform retrospective endpoint and network hunts across the entire April–July time frame using the indicators and YARA rules provided in this post.

Guidance for Software Vendors & Developers

Software supply chain security extends beyond developer workstations and build pipelines. When desktop software relies on remote configuration files to manage update and notification behaviors, adversaries can target the distribution layer rather than the source code. To defend against configuration tampering and distribution-channel hijacking, software vendors should implement the following security controls:

End-to-End Cryptographic Signature Verification : Client applications must cryptographically verify Authenticode digital signatures and validate vendor certificates on all downloaded executables and archives before extraction or execution. Update clients should never rely solely on transport-layer HTTPS or remote checksums (such as cleartext MD5 values in an unauthenticated configuration file).

Cryptographically Signed Configuration Files : Remote configuration files (.ini, .json, or .xml) should be digitally signed using asymmetric public key cryptography. If an origin server or content delivery network (CDN) is modified without authorization, client software will detect the invalid signature and reject the configuration.

Domain Allowlisting and Destination Pinning : Software update clients should enforce strict destination pinning, restricting update downloads exclusively to official, pre-approved vendor domains and CDNs. Update engines should reject redirection to arbitrary third-party domains or generic public cloud storage buckets.

Restricting Uniform Resource Identifier (URI) Schemes in In-App Handlers : Embedded web views, promotional popups, and notification handlers should strictly enforce secure web protocols ( https:// ) and explicitly disallow local file ( file:// ) and UNC WebDAV schemes to prevent external NTLM credential coercion.

Decoupling Core Updates from Marketing Channels : Separating essential software maintenance routines from dynamic promotional popups and notification banners reduces the attack surface and ensures that advertising channels cannot trigger local code execution.

Origin Integrity Monitoring and Access Controls : Origin web servers and object storage buckets hosting update metadata should enforce strict access controls, multi-factor authentication, and automated real-time file integrity monitoring (FIM) with immediate alerting on configuration changes.

Guidance for Security Operations (SOC) & Incident Responders

Overcoming the "Point-in-Time" Triage Pitfall

The short-burst nature of this attack creates a unique challenge for incident response:

The Triage Trap : When an EDR alert fires for a suspicious process spawned by an updater, SOC analysts frequently attempt to validate the alert by navigating to the vendor's download URL or checking URL reputation. Because the threat actor reverted the remote configuration files within five to ten minutes, the vendor's server returns authentic, clean files most of the time, leading analysts to mistakenly dismiss the detection as a false positive.

Actionable IR Protocol : Defenders must not rely on live web checks. Incident responders must preserve and analyze the endpoint-cached configuration files in %PROGRAMFILES(X86)%\AOMEI\*\Tmphtml\ and review proxy/firewall telemetry corresponding to the precise second the alert was triggered.

Camouflaged Follow-on Activity

The deployment of Adaptix C2 under the guise of Nitro PDF can mislead analysts into treating alerts as isolated, user-initiated software downloads rather than staged lateral movement. Responders must trace updater parentage to identify root-cause supply chain tampering.

Endpoint and Network Hardening Actions

Inspect systems for the following directories and artifacts. Defenders must distinguish between malicious payloads and legitimate signed binaries abused for -order hijacking:

Malicious Artifacts (Primary IOCs)

Abused Legitimate / Support Binaries

Defender Triage & Hunting Guidance

%LOCALAPPDATA%\Radmin\

BlkScrDl.dll, csvc\RuntimeComponent.dll, config.zip, metadata.dat

FamItrfc.exe, FamItrf2.exe, WinLpcDl.dll, WinLpcDl2.dll

Do not dismiss if executables are signed: FamItrfc.exe is authentic Famatech software abused to hijack BlkScrDl.dll . Alert on unsigned DLLs and executions with --runtimechk .

%LOCALAPPDATA%\Nitro Pro\

Eztwain4.dll (ADAPTAGENT), NitroPromotion.exe

mfc140u.dll (Microsoft MFC runtime), Nitro_Scan2PDFApp.exe

Payloads masquerade as Nitro PDF tools. Eztwain4.dll is sideloaded by the executables. Look for parent PowerShell processes spawned with -WindowStyle Hidden .

Ephemeral child processes spawned with --nitrod to purge CROSSROAD via NTFS stream overwrites ( :wtfbbq ).

AOMEI Install Paths ( Tmphtml\, html\ )

upgrade-now.zip, upgrade-now.exe (CROSSROAD)

down_html.ini, Notifycfg.ini

Staging location for the AOMEI update flow. Check for unauthorized executable drops in the web UI html\ directory.

Table 1: Endpoint file checks

Scheduled Tasks and Registry

Scheduled Tasks: Check for unauthorized tasks named \NitroRuntime or \RadminComponentRuntime .

Registry: Check \REGISTRY\MACHINE\SYSTEM\Software\Microsoft\TIP\AggregateResults\data for unusual binary blobs.

Block outbound network connections to promotion.storage-data.com , aomei.storage-data.com , storage-data.com , 8.210.84.56 , 47.239.60.117 , and 8.218.65.184 .

Block outbound SMB (TCP 445) and WebDAV traffic to external IP addresses to prevent NTLM credential coercion.

Inspect proxy and web gateway logs for the User-Agent Anyviewer-loader/1.0 or requests to Alibaba Cloud OSS endpoint serv.oss-cn-hongkong.aliyuncs.com .

Indicators of Compromise (IOCs)

To assist the wider community in hunting and identifying activity outlined in this blog post, we have included indicators of compromise (IOCs) in a GTI Collection for registered users.

Malicious File Hashes (SHA-256)

upgrade-now.zip (May 20 CROSSROAD Archive)

6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7

upgrade-now.exe (May 20 CROSSROAD Loader)

11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad

upgrade-now.exe (July 16 CROSSROAD Loader)

9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450

upgrade-now.exe (July 20 CROSSROAD Loader)

b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21

upgrade-now.zip (July 20 CROSSROAD Archive)

9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba

component.zip / en.zip (SHINYROAD Package)

d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464

RuntimeComponent.dll ( Custom PocketPy Engine)

8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8

BlkScrDl.dll (Malicious DLL)

5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e

config.zip (Python Bytecode Archive)

4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b

metadata.dat (ChaCha20 Payload)

4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431

axmlx. (Benign Decoy file)

d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c

NitroPromotion.exe (Launcher for ADAPTAGENT Masquerading as a Nitro Executable)

14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591

Eztwain4.dll (ADAPTAGENT Helper DLL)

8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4

abe.exe (Secondary Payload)

7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d

Table 2: Malicious File Indicators

Legitimate File Hashes (SHA-256)

WinLpcDl.dll ( Legitimate Radmin component)

2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b

WinLpcDl2.dll ( Legitimate Radmin component)

dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951

Nitro_Scan2PDFApp.exe (Legitimate Signed Binary, Abused for Sideloading)

d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd

Table 3: Legitimate File Indicators

Configuration File Hashes (AOMEI .ini )

down_html.ini (Tampered July 16, 08:33–08:39 UTC)

924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6

Notifycfg.ini (Tampered July 16 Window)

d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934

Notifycfg.ini (Tampered July 20 WebDAV Version)

286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8

down_html.ini (Tampered July 20, 10:35–10:40 UTC)

f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4

Table 4: Configuration Files

WebDAV NTLM Target Server; Adaptix C2

Historical SHINYROAD C2 Server. Ports used included 41397 and 443

Secondary Infrastructure

Allowlist IP configured in whitelist.ini (observed June 22, 2026)

promotion.storage-data.com

Stage-2 Dropper Staging Domain

aomei.storage-data.com

Stage-3 Payload Staging Server

serv.oss-cn-hongkong.aliyuncs.com

Alibaba Cloud OSS Bucket (April/May 2026 Staging)

Stage-2 Dropper Download URL

Target IP Allowlist Endpoint

Stage-3 SHINYROAD Payload URL

July 20 GCS Staging URL

July 20 GCS Component URL

\\8.210.84.56\DavWWWRoot\campaign\24hour-flash-sale.html

WebDAV NTLM Coercion Resource

Table 5: Network Indicators

Mutexes & Scheduled Tasks

Mutex: Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}

Shared memory mapping: Local\963d3c60-d406-4ad6-aa1e-dc8e45061ccf

Scheduled Task: \RadminComponentRuntime

Google Security Operations (SecOps)

Google Security Operations customers have access to these broad category rules and more under the "Mandiant Frontline Threats", “Mandiant Hunting Rules”, and "Applied Threat Intelligence - Curated Prioritization" rule packs. The activity discussed in the blog post is detected in Google Security Operations under the rule names:

Explorer Launching Cmd With Powershell Start Process Command

Suspicious Process Invoking Dllhost Clsid Invocation

ATI Active Breach Rule Match for File IoCs

ATI High Priority Rule Match for Ip Address IoCs

ATI Medium Priority Rule Match for Ip Address IoCs

System32 Binary Copied to Non-Standard Directory

MITRE ATT&CK Techniques

Acquire Infrastructure: Domains

Registration of storage-data.com and the promotion. / aomei. subdomains used for payload staging and callbacks.

Acquire Infrastructure: Web Services

Abuse of Alibaba Cloud OSS ( serv.oss-cn-hongkong.aliyuncs.com ) and a public Cloud Storage bucket ( aomeiupdate ) as high-reputation staging infrastructure.

Stage Capabilities: Upload Malware

Staging of upgrade-now.zip , component.zip , and en.zip on actor-controlled domains and cloud storage prior to each tampering window.

Supply Chain Compromise: Compromise Software Supply Chain

Ephemeral modification of remote AOMEI .ini update configuration files.

Command and Scripting Interpreter: PowerShell

Hidden PowerShell execution ( -WindowStyle Hidden ) executing the Nitro PDF / Adaptix C2 payload.

Command and Scripting Interpreter: Python

In-memory execution of compiled bytecode via an embedded PocketPy interpreter ( RuntimeComponent.dll / WNTestDll.dll ).

Inter-Process Communication: Component Object Model

BlkScrDl.dll registers CLSID {21191641-0D7F-4CD9-9572-01AAE6E7851B} as an in-process COM server, causing the Radmin process to load csvc\RuntimeComponent.dll .

Scheduled Task/Job: Scheduled Task

Scheduled tasks \RadminComponentRuntime (running FamItrfc.exe --runtimechk ) and \NitroRuntime .

Hijack Execution Flow: DLL

-order hijacking of BlkScrDl.dll by the signed FamItrfc.exe , and side-loading of Eztwain4.dll by the Nitro PDF masquerading loaders.

Validation of the AOMEI directory substring and external IP reflection filtering before secondary payload retrieval.

Masquerading: Match Legitimate Resource Name or Location

BlkScrDl.dll masquerades as Radmin's legitimate "blank screen" driver library; ADAPTAGENT loaders masquerade as Nitro PDF tools ( NitroPromotion.exe , Eztwain4.dll ).

Obfuscated Files or Information: Encrypted/Encoded File

SHINYROAD stage-2 Python bytecode stored as ChaCha20-encrypted metadata.dat inside config.zip .

Deobfuscate/Decode Files or Information

RuntimeComponent.dll decrypts metadata.dat in memory using ChaCha20 with an HMAC-SHA256 derived key and IV.

Indicator Removal: File Deletion

Self-deletion of CROSSROAD ( upgrade-now.exe ) via a child process spawned with --nitrod .

Hide Artifacts: NTFS File Attributes

CROSSROAD renames its primary :$DATA stream to an alternate data stream named :wtfbbq before flagging the file for deletion on handle close.

Forced Authentication

WebDAV NTLM coercion via an invisible 1x1 popup rendering a UNC resource, configured inside Notifycfg.ini .

System Network Configuration Discovery

CROSSROAD resolves the host's external IP via myip.opendns.com , o-o.myaddr.l.google.com , checkip.amazonaws.com , api.ipify.org , ifconfig.me/ip , and icanhazip.com .

System Location Discovery

CROSSROAD aborts its primary payload execution path when the IP-derived country code is "CN" (China).

System Information Discovery

SHINYROAD fingerprints the victim hostname to derive a unique agent identifier.

System Owner/User Discovery

SHINYROAD incorporates the logged-on username into its unique agent identifier and C2 key derivation.

Ingress Tool Transfer

CROSSROAD downloads component.zip / en.zip to %TEMP%\svc .tmp and unpacks it to %LOCALAPPDATA%\Radmin\ .

SHINYROAD custom binary C2 over TCP 41397 ; ADAPTAGENT beacons over TCP 6800 .

Encrypted Channel: Symmetric Cryptography

Custom binary C2 stream encrypted with a hardcoded handshake key, rotating to a host-specific key derived from the agent ID.

Data Obfuscation: Junk Data

SHINYROAD generates randomized junk packets (traffic chaffing) to disrupt network signature matching.

Remote Access Tools: Remote Desktop Software

Deployment of legitimate Famatech Radmin 3.x server components to victim hosts alongside the SHINYROAD backdoor.

Table 6: MITRE ATT&CK techniques

GTIG and Mandiant would like to thank the ManageEngine Threat Analysis Lab ( METAL ) research team for their initial discovery of this activity, proactive telemetry sharing, and ongoing collaboration to help secure our mutual customer bases and the broader software ecosystem.

ARMORY CASTLE Exploits BeyondTrust

Vulnerability Discovery and Exploitation Trends in the AI Era

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

By Mandiant • 18-minute read

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack on AOMEI Backupper Delivers Backdoor via Update Servers Between May and July 2026, attackers tampered with AOMEI Backupper's update servers, delivering a backdoor to users who checked for updates during specific time windows. The attack exploited a lack of cryptographic verification in the update process, allowing malicious files to be downloaded and executed with the same privileges as the AOMEI process. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab confirmed that organizations in IT services, telecommunications, and higher education across 11 countries, including the United States and India, were affected. AOMEI has reported fixing its servers, but the backdoor remains on already compromised machines. The attack was opportunistic, targeting any system that checked for updates during the tampering windows. The specific dates of tampering included May 28, July 16, and July 20, 2026, with the potential for more incidents not observed. The backdoor installed Radmin, a remote administration tool, alongside an attacker-built DLL, allowing further exploitation. 1 sources 64

Extracted Entities

Google Threat Intelligence Group, Mandiant

The full story

Extracted Entities

Attack Types (1)

Campaigns (2)

Companies (1)

Countries (11)

Domains (11)

Industries (3)

IP Addresses (3)

Malware (3)

MITRE ATT&CK (1)

Platforms (2)

SHA256 Hashes (21)