---
title: Hunt: AOMEI CROSSROAD/SHINYROAD (executables in AOMEI html\, RadminComponentRuntime task, --runtimechk, Radmin side-load) | ctxsec
url: https://ctxsec.com/items/hunt-aomei-crossroad-shinyroad
description: ""
status: "vendor IOCs/TTPs"
published: 2026-10-16
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-aomei-crossroad-shinyroad.md)

vendor IOCs/TTPs

2026-10-16

### Hunt: AOMEI CROSSROAD/SHINYROAD (executables in AOMEI html\, RadminComponentRuntime task, --runtimechk, Radmin side-load)

From GTIG/Mandiant's triage table: look for any executable, especially `upgrade-now.exe`, under AOMEI's `html\` or `Tmphtml\` directories (that folder only holds rendering assets). Check for scheduled tasks `\RadminComponentRuntime` or `\NitroRuntime`, processes launched with `--runtimechk` or `--nitrod`, and files under `%LOCALAPPDATA%\Radmin\` (`BlkScrDl.dll`, `csvc\RuntimeComponent.dll`, `config.zip`, `metadata.dat`). Signed `FamItrfc.exe` is genuine Famatech software being abused to load an unsigned DLL, so don't clear it on signature alone. Also watch for `Eztwain4.dll` beside Nitro-named executables in `%LOCALAPPDATA%\Nitro Pro\` launched by hidden-window PowerShell, and for unsigned children of `Backupper.exe` or `ABNotify.exe`. Query sketch (KQL): `DeviceProcessEvents | where InitiatingProcessFileName in~ ('Backupper.exe','ABNotify.exe') or ProcessCommandLine has_any ('--runtimechk','--nitrod')`. Sweep the whole April–July 2026 range; hashes and YARA rules are in the GTIG post.

Sources: [GTIG/Mandiant: Investigating Ephemeral Supply Chain Tampering](https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering) · [ManageEngine METAL analysis](https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html)