The ShinyRoad backdoor emerged from a supply-chain campaign in which attackers manipulated AOMEI Backupper’s software distribution infrastructure to deliver malware to Windows endpoints. Between April and July 2026, the threat actor UNC7017 repeatedly modified server-side configurations for approximately five to ten minutes before restoring legitimate content.
Investigations by Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine Threat Analysis Lab (METAL) identified a multi-stage infection chain involving the CROSSROAD downloader, malicious DLL sideloading, and SHINYROAD remote-access malware.
Compromised organizations included higher-education, IT-services, and telecommunications entities. The short exposure windows created a significant forensic challenge: a clean vendor download today cannot establish that previously exposed endpoints remain uncompromised.
How did attackers compromise AOMEI Backupper’s distribution mechanism?
The campaign exploited trust in AOMEI Backupper’s update and promotional-content delivery workflow rather than requiring modification of the software’s original source code.
Two configuration files controlled critical behavior:
down_html.ini: Specified downloadable content, its location, and an MD5 checksum.
Notifycfg.ini: Controlled notification behavior and executable content delivered through the promotional interface.
Neither configuration file was cryptographically authenticated by the client. Because the expected checksum was supplied through the same untrusted configuration mechanism, attackers could replace both the download location and its checksum.
This allowed a malicious archive to pass the application’s existing integrity check.
METAL documented three observed exposure windows:
Date (2026)
UTC exposure window
Duration
May 28
05:40–05:50
10 minutes
July 16
08:33–08:39
6 minutes
July 20
10:35–10:40
5 minutes
The attackers restored legitimate configurations after each window. Consequently, subsequent checks of the distribution infrastructure could miss the earlier compromise.
How does the ShinyRoad backdoor infection chain work?
The infection used multiple components to separate initial execution, payload staging, persistence, and command-and-control communication.
Observed Attack Sequence
Compromised AOMEI configuration
Redirected promotional-content download
↓
CROSSROAD downloader
Environment checks, staging, persistence
↓
Signed Radmin executable + malicious DLL
DLL sideloading and implant initialization
↓
SHINYROAD backdoor
Outbound C2 communication and remote execution
1: CROSSROAD establishes the infection
Initial execution: The malicious archive launched upgrade-now.exe, initiating CROSSROAD.
Payload staging: CROSSROAD performed environment checks and installed a legitimate Radmin executable alongside malicious files.
Persistence: The scheduled task RadminComponentRuntime executed FamItrfc.exe –runtimechk every three hours.
Self-deletion: CROSSROAD deleted itself after staging the payload.
2: DLL sideloading activates SHINYROAD
DLL sideloading: Signed FamItrfc.exe loaded malicious BlkScrDl.dll.
COM execution: BlkScrDl.dll registered RuntimeComponent.dll through a signed dllhost.exe surrogate.
Payload execution: RuntimeComponent.dll decrypted ChaCha20-encrypted metadata.dat and executed it using PocketPy.
Additional payload: Researchers observed AdaptAgent deployment following SHINYROAD infections.
C2 framework: AdaptAgent was associated with the Adaptix command-and-control framework.
Expanded access: This provided attackers with additional post-exploitation capabilities beyond SHINYROAD.
What is Threat Analysis?
Learn how threat analysis identifies risks, investigates incidents, and strengthens security.
How did the campaign attempt to expose Windows credentials?
On July 20, UNC7017 manipulated Notifycfg.ini to trigger outbound Windows authentication requests and potentially capture NetNTLMv2 challenge-response material.
Configuration tampering: Attackers replaced a promotional banner with an invisible 1×1-pixel popup assigned priority 9999.
Credential coercion: A file:// path containing DavWWWRoot directed Windows toward an attacker-controlled WebDAV endpoint.
Potential exploitation: Captured NetNTLMv2 responses could support offline password cracking or certain relay attacks.
However, exposure of a NetNTLMv2 response does not confirm plaintext password theft or successful account compromise.
Why does the ShinyRoad backdoor threaten enterprise environments?
The primary concern is persistent endpoint compromise after the original distribution mechanism has been restored.
Organizations face several operational risks:
Persistent access: Scheduled tasks can relaunch malicious components after the initial downloader disappears.
Trusted-binary abuse: Legitimate signed executables can load malicious DLLs, complicating signature-based investigations.
Credential exposure: WebDAV authentication requests may disclose material useful for subsequent authentication attacks.
Forensic blind spots: Self-deleting loaders and restored configurations can obscure the initial infection timeline.
Backup infrastructure risk: Compromised hosts involved in backup operations may expose sensitive data or disrupt recovery workflows.
These are potential consequences; the available reporting does not establish that every affected organization experienced each outcome.
How can Hexnode XDR support ShinyRoad backdoor investigations?
Hexnode XDR provides endpoint investigation and response capabilities for supported, enrolled devices. Its incident workflow can help administrators investigate suspicious process execution and contain validated threats.
Investigate suspicious execution chains
Security teams can use Hexnode XDR’s incident metadata and process analysis to examine:
Parent-child execution relationships associated with suspicious backup software activity.
Process command lines, file paths, and SHA-256 hashes.
Unexpected executable launches and suspicious DLL-associated activity where captured by available telemetry.
Recorded events that may indicate persistent malware execution.
Analysts should correlate these findings with Windows scheduled-task records, file-
Contain validated endpoint threats
After preserving relevant evidence and confirming malicious activity, administrators can use supported Hexnode XDR actions to:
Kill Process or Kill Process Tree: Terminate identified malicious execution.
Quarantine File: Restrict access to confirmed malicious components.
Endpoint Isolation: Limit network communication while retaining the XDR management connection.
Export incident data: Preserve available threat records for investigation and reporting.
These actions should follow an approved incident-response procedure. Isolating backup-dependent endpoints without assessing recovery requirements could interrupt essential operations.
Hexnode XDR does not provide confirmed SHINYROAD-specific detection, repair compromised vendor distribution infrastructure, or independently remediate exposed credentials.
Featured resource
Cybersecurity kit
Access cybersecurity guides, checklists, policy templates, and frameworks to strengthen enterprise security and incident management.
What should organizations prioritize after the AOMEI compromise?
Security teams should investigate potentially exposed Windows hosts rather than relying solely on current software downloads.
Identify exposure: Inventory AOMEI Backupper installations and correlate historical update activity with known tampering windows.
Preserve evidence: Collect process telemetry, relevant logs, scheduled-task definitions, and suspicious files before remediation.
Hunt for persistence: Examine RadminComponentRuntime, NitroRuntime, and unexpected executables or DLLs in application-data directories.
Investigate authentication activity: Review outbound WebDAV connections and assess possible NetNTLMv2 exposure.
Contain and recover: Remove confirmed malicious components, assess credential remediation needs, and verify endpoint integrity before restoring normal operations.
FAQs
Is ShinyRoad a vulnerability in AOMEI Backupper?
No CVE was identified in the published investigation. Attackers compromised server-side configurations and abused existing content-delivery and execution functionality.
Can reinstalling AOMEI Backupper remove ShinyRoad?
Not necessarily. Persistence mechanisms and malicious components may survive application reinstallation. Organizations should verify host integrity and remove confirmed malicious artifacts.
Does restoring legitimate update files eliminate the threat?
No. Restoring distribution content prevents continued delivery through the same malicious configuration but does not remove malware already installed on affected endpoints.
Conclusion
The ShinyRoad backdoor campaign demonstrates how short-lived configuration tampering can produce persistent endpoint compromise without modifying legitimate software releases.
For enterprise security teams, effective recovery requires historical process analysis, persistence hunting, credential-exposure assessment, and verified remediation. A clean download source is not evidence of a clean endpoint.
Investigate endpoint threats with Hexnode XDR
Investigate suspicious activity, analyze security incidents, and contain endpoint threats with Hexnode.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
