{"id":2321,"date":"2026-10-22T14:31:57","date_gmt":"2026-10-22T09:01:57","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=2321"},"modified":"2026-10-27T10:55:09","modified_gmt":"2026-10-27T05:25:09","slug":"shinyroad-backdoor-investigating-backup-software-supply-chain-compromise","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/","title":{"rendered":"ShinyRoad Backdoor: Investigating Backup Software Supply-Chain Compromise"},"content":{"rendered":"<p>The ShinyRoad backdoor emerged from a supply-chain campaign in which attackers manipulated AOMEI Backupper&#8217;s software distribution infrastructure to deliver malware to Windows endpoints. Between April and July 2026, the threat actor UNC7017 repeatedly modified server-side configurations for approximately five to ten minutes before restoring legitimate content.<\/p>\n<p>Investigations by Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine Threat Analysis Lab (METAL) identified a multi-stage infection chain involving the CROSSROAD downloader, malicious DLL sideloading, and SHINYROAD remote-access malware.<\/p>\n<p>Compromised organizations included higher-education, IT-services, and telecommunications entities. The short exposure windows created a significant forensic challenge: a clean vendor download today cannot establish that previously exposed endpoints remain uncompromised.<\/p>\n<h2>How did attackers compromise AOMEI Backupper&#8217;s distribution mechanism?<\/h2>\n<p>The campaign exploited trust in AOMEI Backupper&#8217;s update and promotional-content delivery workflow rather than requiring modification of the software&#8217;s original source code.<\/p>\n<p>Two configuration files controlled critical behavior:<\/p>\n<ul>\n<li><strong>down_html.ini:<\/strong> Specified downloadable content, its location, and an MD5 checksum.<\/li>\n<li><strong>Notifycfg.ini:<\/strong> Controlled notification behavior and executable content delivered through the promotional interface.<\/li>\n<\/ul>\n<p>Neither configuration file was cryptographically authenticated by the client. Because the expected checksum was supplied through the same untrusted configuration mechanism, attackers could replace both the download location and its checksum.<\/p>\n<p>This allowed a malicious archive to pass the application&#8217;s existing integrity check.<\/p>\n<p>METAL documented three observed exposure windows:<\/p>\n<table style=\"width: 65.9284%;\">\n<thead>\n<tr>\n<th style=\"width: 26.7196%; text-align: left;\">Date (2026)<\/th>\n<th style=\"width: 35.8008%; text-align: left;\">UTC exposure window<\/th>\n<th style=\"width: 101.765%; text-align: left;\">Duration<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"width: 26.7196%;\">May 28<\/td>\n<td style=\"width: 35.8008%;\">05:40\u201305:50<\/td>\n<td style=\"width: 101.765%;\">10 minutes<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 26.7196%;\">July 16<\/td>\n<td style=\"width: 35.8008%;\">08:33\u201308:39<\/td>\n<td style=\"width: 101.765%;\">6 minutes<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 26.7196%;\">July 20<\/td>\n<td style=\"width: 35.8008%;\">10:35\u201310:40<\/td>\n<td style=\"width: 101.765%;\">5 minutes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The attackers restored legitimate configurations after each window. Consequently, subsequent checks of the distribution infrastructure could miss the earlier compromise.<\/p>\n<h2>How does the ShinyRoad backdoor infection chain work?<\/h2>\n<p>The infection used multiple components to separate initial execution, payload staging, persistence, and<a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-command-and-control-c2\/\"> command-and-control<\/a> communication.<\/p>\n<div class=\"attack-sequence\">\n<h3>Observed Attack Sequence<\/h3>\n<div class=\"attack-step\">\n<div style=\"text-align: center;\">\n<h4>Compromised AOMEI configuration<\/h4>\n<p>Redirected promotional-content download<\/p>\n<p style=\"font-size: 24px;\">\u2193<\/p>\n<h4>CROSSROAD downloader<\/h4>\n<p>Environment checks, staging, persistence<\/p>\n<p style=\"font-size: 24px;\">\u2193<\/p>\n<h4>Signed Radmin executable + malicious DLL<\/h4>\n<p>DLL sideloading and implant initialization<\/p>\n<p style=\"font-size: 24px;\">\u2193<\/p>\n<h4>SHINYROAD backdoor<\/h4>\n<p>Outbound C2 communication and remote execution<\/p>\n<\/div>\n<\/div>\n<\/div>\n<h3>1: CROSSROAD establishes the infection<\/h3>\n<ul>\n<li><strong>Initial execution:<\/strong> The malicious archive launched upgrade-now.exe, initiating CROSSROAD.<\/li>\n<li><strong>Payload staging:<\/strong> CROSSROAD performed environment checks and installed a legitimate Radmin executable alongside malicious files.<\/li>\n<li><strong>Persistence:<\/strong> The scheduled task RadminComponentRuntime executed FamItrfc.exe &#8211;runtimechk every three hours.<\/li>\n<li><strong>Self-deletion:<\/strong> CROSSROAD deleted itself after staging the payload.<\/li>\n<\/ul>\n<h3>2: DLL sideloading activates SHINYROAD<\/h3>\n<ul>\n<li><strong>DLL sideloading:<\/strong> Signed FamItrfc.exe loaded malicious BlkScrDl.dll.<\/li>\n<li><strong>COM execution:<\/strong> BlkScrDl.dll registered RuntimeComponent.dll through a signed dllhost.exe surrogate.<\/li>\n<li><strong>Payload execution:<\/strong> RuntimeComponent.dll decrypted ChaCha20-encrypted metadata.dat and executed it using PocketPy.<\/li>\n<li><strong>C2 communication:<\/strong> SHINYROAD supported outbound connections, remote command execution, and additional payload delivery.<\/li>\n<\/ul>\n<h3>3: Additional post-exploitation tooling<\/h3>\n<ul>\n<li><strong>Additional payload:<\/strong> Researchers observed AdaptAgent deployment following SHINYROAD infections.<\/li>\n<li><strong>C2 framework:<\/strong> AdaptAgent was associated with the Adaptix command-and-control framework.<\/li>\n<li><strong>Expanded access:<\/strong> This provided attackers with additional post-exploitation capabilities beyond SHINYROAD.<\/li>\n<\/ul>\n<div class=\"next_blog\"><div class=\"post-next\"><div class=\"hex_blog_box_parent\"><div class=\"blog_warp_next\"><div class=\"next_blog_thumb\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/threat-analysis-.jpeg?format=webp)\"><\/div><div class=\"next_post_content\"><div class=\"center_box\"><h4>What is Threat Analysis?<\/h4><p>Learn how threat analysis identifies risks, investigates incidents, and strengthens security.<\/p><\/div><\/div><\/div><a class=\"hex_blog_box_link hn-cta__blogs--blog-box\" href=\"https:\/\/www.hexnode.com\/blogs\/what-is-threat-analysis\/\" aria-label=\"What is Threat Analysis?\"><\/a><\/div><\/div><\/div>\n<h2>How did the campaign attempt to expose Windows credentials?<\/h2>\n<p>On July 20, UNC7017 manipulated Notifycfg.ini to trigger outbound Windows authentication requests and potentially capture NetNTLMv2 challenge-response material.<\/p>\n<ul>\n<li><strong>Configuration tampering:<\/strong> Attackers replaced a promotional banner with an invisible 1\u00d71-pixel popup assigned priority 9999.<\/li>\n<li><strong>Credential coercion:<\/strong> A file:\/\/ path containing DavWWWRoot directed Windows toward an attacker-controlled WebDAV endpoint.<\/li>\n<li><strong>Potential exploitation:<\/strong> Captured NetNTLMv2 responses could support offline password cracking or certain relay attacks.<\/li>\n<\/ul>\n<p>However, exposure of a NetNTLMv2 response does not confirm plaintext password theft or successful account compromise.<\/p>\n<h2>Why does the ShinyRoad backdoor threaten enterprise environments?<\/h2>\n<p>The primary concern is persistent endpoint compromise after the original distribution mechanism has been restored.<\/p>\n<p>Organizations face several operational risks:<\/p>\n<ul>\n<li><strong>Persistent access:<\/strong> Scheduled tasks can relaunch malicious components after the initial downloader disappears.<\/li>\n<li><strong>Trusted-binary abuse:<\/strong> Legitimate signed executables can load malicious DLLs, complicating <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-signature-based-detection\/\">signature-based investigations<\/a>.<\/li>\n<li><strong>Credential exposure:<\/strong> WebDAV authentication requests may disclose material useful for subsequent authentication attacks.<\/li>\n<li><strong>Forensic blind spots:<\/strong> Self-deleting loaders and restored configurations can obscure the initial infection timeline.<\/li>\n<li><strong>Backup infrastructure risk:<\/strong> Compromised hosts involved in backup operations may expose sensitive data or disrupt recovery workflows.<\/li>\n<\/ul>\n<p>These are potential consequences; the available reporting does not establish that every affected organization experienced each outcome.<\/p>\n<h2>How can Hexnode XDR support ShinyRoad backdoor investigations?<\/h2>\n<p><a href=\"https:\/\/www.hexnode.com\/xdr\/\">Hexnode XDR<\/a> provides endpoint investigation and response capabilities for supported, enrolled devices. Its incident workflow can help administrators investigate suspicious process execution and contain validated threats.<\/p>\n<h3>Investigate suspicious execution chains<\/h3>\n<p>Security teams can use Hexnode XDR&#8217;s incident metadata and process analysis to examine:<\/p>\n<ul>\n<li>Parent-child execution relationships associated with suspicious backup software activity.<\/li>\n<li>Process command lines, file paths, and SHA-256 hashes.<\/li>\n<li>Unexpected executable launches and suspicious DLL-associated activity where captured by available telemetry.<\/li>\n<li>Recorded events that may indicate persistent malware execution.<\/li>\n<\/ul>\n<p>Analysts should correlate these findings with Windows scheduled-task records, file-<\/p>\n<h3>Contain validated endpoint threats<\/h3>\n<p>After preserving relevant evidence and confirming malicious activity, administrators can use supported Hexnode XDR actions to:<\/p>\n<ul>\n<li><strong>Kill Process or Kill Process Tree:<\/strong> Terminate identified malicious execution.<\/li>\n<li><strong>Quarantine File:<\/strong> Restrict access to confirmed malicious components.<\/li>\n<li><strong>Endpoint Isolation:<\/strong> Limit network communication while retaining the <a href=\"https:\/\/www.hexnode.com\/blogs\/xdr-extended-detection-and-response\/\">XDR<\/a> management connection.<\/li>\n<li><strong>Export incident data:<\/strong> Preserve available threat records for investigation and reporting.<\/li>\n<\/ul>\n<p>These actions should follow an approved incident-response procedure. Isolating backup-dependent endpoints without assessing recovery requirements could interrupt essential operations.<\/p>\n<p>Hexnode XDR does not provide confirmed SHINYROAD-specific detection, repair compromised vendor distribution infrastructure, or independently remediate exposed credentials.<\/p>\n<section id='resource-single'>\n                    <div class='resource-box'>\n                        <div class='resource-box__image-section'>\n                            <div class='resource-box__image-wrap'>\n                                <img decoding=\"async\" src=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit-.jpg?format=webp\" class=\"resource-box__image\" alt=\"cybersecurity kit\" loading=\"lazy\" srcset=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit-.jpg?format=webp 960w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--300x225.jpg?format=webp 300w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--768x576.jpg?format=webp 768w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--133x100.jpg?format=webp 133w\" sizes=\"auto, (max-width: 960px) 100vw, 960px\" title=\"cybersecurity kit\" \/>\n                            <\/div>\n                        <\/div>\n                        <div class='resource-box__content-section'>\n                            <h5 class='resource-box__content-subheading'>\n                            Featured resource\n                            <\/h5>\n                            <h4 class='resource-box__content-heading'>\n                            Cybersecurity kit\n                            <\/h4>\n                            <p class='resource-box__contents'>\n                            Access cybersecurity guides, checklists, policy templates, and frameworks to strengthen enterprise security and incident management.\n                            <\/p>\n                            <a class='resource-box__content-link hn-cta__blogs--resource-box' href='https:\/\/www.hexnode.com\/resources\/resource-kits\/cybersecurity-kit\/'>\n                            DOWNLOAD\n                            <svg xmlns='http:\/\/www.w3.org\/2000\/svg' width='20' height='20' viewBox='0 0 20 20'>\n                            <g id='arrow' transform='translate(-309 -191)' opacity='0'>\n                                <rect id='base' width='20' height='20' transform='translate(309 191)' fill='none'\/>\n                                <path id='arrow-2' data-name='arrow' d='M13.093.5,6.8,6.8.5.5' transform='translate(315 207.594) rotate(-90)' fill='none' stroke='#0549d1' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.2'\/>\n                            <\/g>\n                            <\/svg>\n\n                            <\/a>\n                        <\/div>\n                    <\/div>\n                <\/section>\n<h2>What should organizations prioritize after the AOMEI compromise?<\/h2>\n<p>Security teams should investigate potentially exposed Windows hosts rather than relying solely on current software downloads.<\/p>\n<ul>\n<li><strong>Identify exposure:<\/strong> Inventory AOMEI Backupper installations and correlate historical update activity with known tampering windows.<\/li>\n<li><strong>Preserve evidence:<\/strong> Collect process telemetry, relevant logs, scheduled-task definitions, and suspicious files before remediation.<\/li>\n<li><strong>Hunt for persistence:<\/strong> Examine RadminComponentRuntime, NitroRuntime, and unexpected executables or DLLs in application-data directories.<\/li>\n<li><strong>Investigate authentication activity:<\/strong> Review outbound WebDAV connections and assess possible NetNTLMv2 exposure.<\/li>\n<li><strong>Contain and recover:<\/strong> Remove confirmed malicious components, assess credential remediation needs, and verify endpoint integrity before restoring normal operations.<\/li>\n<\/ul>\n<div class=\"faq-section-wrapper\" itemscope itemtype=\"https:\/\/schema.org\/FAQPage\"><h2 class=\"faq-main-title\">FAQs<\/h2><div class=\"faq-items\"><div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Is ShinyRoad a vulnerability in AOMEI Backupper?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>No CVE was identified in the published investigation. Attackers compromised server-side configurations and abused existing content-delivery and execution functionality.<\/p>\n<\/div><\/div><\/div>\n<div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Can reinstalling AOMEI Backupper remove ShinyRoad?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>Not necessarily. Persistence mechanisms and malicious components may survive application reinstallation. Organizations should verify host integrity and remove confirmed malicious artifacts.<\/p>\n<\/div><\/div><\/div>\n<div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Does restoring legitimate update files eliminate the threat?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>No. Restoring distribution content prevents continued delivery through the same malicious configuration but does not remove malware already installed on affected endpoints.<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n<h3>Conclusion<\/h3>\n<p>The ShinyRoad backdoor campaign demonstrates how short-lived configuration tampering can produce persistent endpoint compromise without modifying legitimate software releases.<\/p>\n<p>For enterprise security teams, effective recovery requires historical process analysis, persistence hunting, credential-exposure assessment, and verified remediation. A clean download source is not evidence of a clean endpoint.<\/p>\n<div class=\"signup_box\"><div class=\"signup_wrap_img\"><div class=\"signup-bg\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/Hexnode-MDM-free-trial.jpg?format=webp)\"><\/div><\/div><div class=\"signup_wrap\"><h5>Investigate endpoint threats with Hexnode XDR <\/h5><p>Investigate suspicious activity, analyze security incidents, and contain endpoint threats with Hexnode.<\/p><a href=\"https:\/\/www.hexnode.com\/xdr\/signup\/\" class=\"hn-cta__blogs--signup-stripe\" target=\"_blank\"> SIGN UP NOW<\/a><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>The ShinyRoad backdoor emerged from a supply-chain campaign in which attackers manipulated AOMEI Backupper&#8217;s software&#8230;<\/p>\n","protected":false},"author":5,"featured_media":2343,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[14,15],"class_list":["post-2321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-supply-chain-attack","category-malware","product_category-extended-detection-and-response","tab_group-malware-and-ransomware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>ShinyRoad Backdoor: AOMEI Supply-Chain Attack Explained<\/title>\n<meta name=\"description\" content=\"Explore ShinyRoad backdoor delivery through backup software, with endpoint investigation, evidence preservation, and containment guidance.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ShinyRoad Backdoor: AOMEI Supply-Chain Attack Explained\" \/>\n<meta property=\"og:description\" content=\"Explore ShinyRoad backdoor delivery through backup software, with endpoint investigation, evidence preservation, and containment guidance.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/\" \/>\n<meta property=\"og:site_name\" content=\"Hexnode Threat Watch\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hexnode\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-22T09:01:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-27T05:25:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/shinyroad-backdoor.jpeg?format=webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1340\" \/>\n\t<meta property=\"og:image:height\" content=\"700\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sophia Hart\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:site\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sophia Hart\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/\"},\"author\":{\"name\":\"Sophia Hart\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\"},\"headline\":\"ShinyRoad Backdoor: Investigating Backup Software Supply-Chain Compromise\",\"datePublished\":\"2026-10-22T09:01:57+00:00\",\"dateModified\":\"2026-10-27T05:25:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/\"},\"wordCount\":1120,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/shinyroad-backdoor.jpeg?format=webp\",\"articleSection\":[\"Supply Chain Attack\",\"Malware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/\",\"name\":\"ShinyRoad Backdoor: AOMEI Supply-Chain Attack Explained\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/shinyroad-backdoor.jpeg?format=webp\",\"datePublished\":\"2026-10-22T09:01:57+00:00\",\"dateModified\":\"2026-10-27T05:25:09+00:00\",\"description\":\"Explore ShinyRoad backdoor delivery through backup software, with endpoint investigation, evidence preservation, and containment guidance.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/shinyroad-backdoor.jpeg?format=webp\",\"contentUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/shinyroad-backdoor.jpeg?format=webp\",\"width\":1340,\"height\":700,\"caption\":\"shinyroad backdoor\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ShinyRoad Backdoor: Investigating Backup Software Supply-Chain Compromise\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"name\":\"Hexnode Threat Watch\",\"description\":\"Latest cyber threats, smarter enterprise response.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"alternateName\":\"Threat Watch\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\",\"name\":\"Hexnode\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"contentUrl\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"width\":100,\"height\":100,\"caption\":\"Hexnode\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Hexnode\\\/\",\"https:\\\/\\\/x.com\\\/thehexnode\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/hexnode\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\",\"name\":\"Sophia Hart\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"caption\":\"Sophia Hart\"},\"description\":\"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/author\\\/sophia-hart\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ShinyRoad Backdoor: AOMEI Supply-Chain Attack Explained","description":"Explore ShinyRoad backdoor delivery through backup software, with endpoint investigation, evidence preservation, and containment guidance.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/","og_locale":"en_US","og_type":"article","og_title":"ShinyRoad Backdoor: AOMEI Supply-Chain Attack Explained","og_description":"Explore ShinyRoad backdoor delivery through backup software, with endpoint investigation, evidence preservation, and containment guidance.","og_url":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/","og_site_name":"Hexnode Threat Watch","article_publisher":"https:\/\/www.facebook.com\/Hexnode\/","article_published_time":"2026-10-22T09:01:57+00:00","article_modified_time":"2026-10-27T05:25:09+00:00","og_image":[{"width":1340,"height":700,"url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/shinyroad-backdoor.jpeg?format=webp","type":"image\/jpeg"}],"author":"Sophia Hart","twitter_card":"summary_large_image","twitter_creator":"@thehexnode","twitter_site":"@thehexnode","twitter_misc":{"Written by":"Sophia Hart","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#article","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/"},"author":{"name":"Sophia Hart","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430"},"headline":"ShinyRoad Backdoor: Investigating Backup Software Supply-Chain Compromise","datePublished":"2026-10-22T09:01:57+00:00","dateModified":"2026-10-27T05:25:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/"},"wordCount":1120,"commentCount":0,"publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/shinyroad-backdoor.jpeg?format=webp","articleSection":["Supply Chain Attack","Malware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/","url":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/","name":"ShinyRoad Backdoor: AOMEI Supply-Chain Attack Explained","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#primaryimage"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/shinyroad-backdoor.jpeg?format=webp","datePublished":"2026-10-22T09:01:57+00:00","dateModified":"2026-10-27T05:25:09+00:00","description":"Explore ShinyRoad backdoor delivery through backup software, with endpoint investigation, evidence preservation, and containment guidance.","breadcrumb":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#primaryimage","url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/shinyroad-backdoor.jpeg?format=webp","contentUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/10\/shinyroad-backdoor.jpeg?format=webp","width":1340,"height":700,"caption":"shinyroad backdoor"},{"@type":"BreadcrumbList","@id":"https:\/\/www.hexnode.com\/threat-watch\/shinyroad-backdoor-investigating-backup-software-supply-chain-compromise\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hexnode.com\/threat-watch\/"},{"@type":"ListItem","position":2,"name":"ShinyRoad Backdoor: Investigating Backup Software Supply-Chain Compromise"}]},{"@type":"WebSite","@id":"https:\/\/www.hexnode.com\/threat-watch\/#website","url":"https:\/\/www.hexnode.com\/threat-watch\/","name":"Hexnode Threat Watch","description":"Latest cyber threats, smarter enterprise response.","publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"alternateName":"Threat Watch","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hexnode.com\/threat-watch\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization","name":"Hexnode","url":"https:\/\/www.hexnode.com\/threat-watch\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/","url":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","contentUrl":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","width":100,"height":100,"caption":"Hexnode"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hexnode\/","https:\/\/x.com\/thehexnode","https:\/\/www.linkedin.com\/company\/hexnode"]},{"@type":"Person","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430","name":"Sophia Hart","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","caption":"Sophia Hart"},"description":"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.","url":"https:\/\/www.hexnode.com\/threat-watch\/author\/sophia-hart\/"}]}},"_links":{"self":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/comments?post=2321"}],"version-history":[{"count":3,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2321\/revisions"}],"predecessor-version":[{"id":2345,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2321\/revisions\/2345"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media\/2343"}],"wp:attachment":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media?parent=2321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/categories?post=2321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}