What Happened
Google Threat Intelligence Group, Mandiant, and ManageEngine report attackers tampered with AOMEI Backupper update files on AOMEI’s servers. The Hacker News lists three windows from late spring to July 2026, each lasting five to ten minutes. Any copy of the software checking for updates in those windows pulled a backdoor.
The root cause is weak verification. The program does not cryptographically verify its update files, and the checksum sits in the same unsigned file as the download link. The CROSSROAD downloader stages a signed Radmin copy, creates a scheduled task, and deletes itself. The SHINYROAD implant then gives the actor a remote shell. Google tracks the actor as UNC7017. Victims in IT services, telecommunications, and higher education span 11 countries.
Why This Matters for Canadian Organizations
The report lists no Canadian victims. The victim sectors still match Canadian managed service providers, telecoms, and universities, and backup tools run with high privilege on most of them. Free and low-cost utilities often sit outside software inventories, so no team watches their update behavior.
The incident also shows a supply chain pattern. A trusted vendor channel delivered the payload over HTTPS, so network controls saw normal traffic. Canadian organizations with PIPEDA safeguard duties or OSFI B-13 third-party risk obligations need to treat unsigned update channels as a control gap.
What to Do
Search endpoints for the RadminComponentRuntime and NitroRuntime scheduled tasks and for unsigned upgrade-now.exe files. Block storage-data[.]com and the listed IP addresses. Block outbound SMB on TCP 445 and WebDAV to external hosts. Hunt across April through July, because a fixed server does not clean an infected machine. Inventory every backup and utility tool and remove software which skips signature checks. See more in our Trends coverage.
