Google Threat Intelligence Group and Mandiant (Oct 15) and ManageEngine's threat lab (Oct 16) report that a cluster tracked as UNC7017 repeatedly altered AOMEI's remote config files between April and July 2026. During each short window, down_html.ini pointed AOMEI Backupper's promotional-content flow at an attacker-hosted upgrade-now.zip and Notifycfg.ini told ABNotify.exe to run it, then authentic files were restored. The client doesn't cryptographically verify either config, and the MD5 it checks is declared in the same unauthenticated file. The CROSSROAD downloader installed a genuine Radmin package with a side-loaded DLL carrying an encrypted PocketPy implant (SHINYROAD). Victims GTIG saw span IT services, telecom and higher education in at least 11 countries including the US, but delivery was opportunistic to any client polling during a window. Mandiant notified AOMEI on July 17; AOMEI said on July 29 it had secured its servers. Server-side fixes don't clean endpoints infected earlier, so hunt back to April.