AOMEI Update Hijacking Delivers CROSSROAD via Config Tampering

AOMEI Technology’s update infrastructure was compromised by threat actors tracked as UNC7017, who manipulated server configurations to distribute the CROSSROAD downloader and SHINYROAD backdoor. This supply chain attack targeted systems running AOMEI Backupper and AnyViewer, exploiting the trust these applications place in their own configuration files to validate software updates.

Root cause

The vulnerability stemmed from how the client applications handled configuration data. Attackers modified two specific files, down_html.ini and Notifycfg.ini, which control download locations and notification behaviors. By changing the package reference and supplying a matching MD5 checksum for their malicious archive, the attackers ensured the trojanized download passed the application’s internal integrity checks without requiring a memory corruption exploit or CVE.

Attack path

UNC7017 briefly altered server configurations during specific windows between April and July 2026. On May 28, July 16, and July 20, the malicious content was available for ten, six, and five minutes respectively. Systems polling the infrastructure during these short intervals received the upgrade-now.zip file containing upgrade-now.exe. After each window, attackers restored legitimate content, leaving conventional checks of the vendor’s servers unable to reproduce the compromise.

Affected versions

• AOMEI Backupper
• AnyViewer
• Systems polling the compromised infrastructure during the active tampering windows in 2026

Mitigation

• Monitor endpoint telemetry for unexpected execution following legitimate software updates.
• Verify that update clients independently authenticate configuration sources, not just content checksums.
• Review logs for connections to known AOMEI update servers during reported compromise windows.
• Isolate endpoints showing signs of CROSSROAD or SHINYROAD activity for forensic analysis.

Detection notes

Security operations teams should focus on endpoint telemetry rather than relying solely on server-side verification, as attackers often restore legitimate content quickly. Check for anomalous outbound connections from update services that do not match known baseline behaviors. Look for execution of new processes spawned by trusted applications shortly after configuration changes. Validate that integrity checks cover the configuration files themselves, not just the downloaded binaries.

What to do and how to stay safe: AOMEI Technology

• Audit your inventory for AOMEI Backupper and AnyViewer installations to assess exposure risk.
• Review endpoint detection logs for any execution of upgrade-now.exe or similar unexpected binaries.
• Implement strict network monitoring for traffic to AOMEI update servers to detect future anomalies.
• Ensure your security tools can detect supply chain compromises by monitoring for config file modifications.

Step-by-step guide: Phishing Defenses: Answers to 10 Critical Questions

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How did the attackers bypass the software's security checks?

They modified configuration files to change the download location and provided a matching MD5 checksum for the malicious archive, allowing it to pass integrity verification.

Which organizations were identified as victims?

Victims included IT services, telecommunications, and higher education organizations across eleven countries, including India, Australia, Brazil, and the United States.

Is there a patch available for this vulnerability?

No fix has been confirmed yet, as the issue involved external server configuration tampering rather than a specific software bug requiring a vendor patch.