[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Playbooks

AOMEI update-channel compromise: retro-hunt April–July 2026

Find and clean endpoints that may have received UNC7017's CROSSROAD/SHINYROAD payload through AOMEI Backupper's promotional update flow. Based on the GTIG/Mandiant and ManageEngine reports of Oct 15–16, 2026.

For: Security lead, SOC / threat hunter, Endpoint admin

1. Inventory AOMEI software2. Sweep for file artifacts3. Check persistence and process history4. Contain and rebuild5. Reduce future exposure
  1. Step 1 of 5

    Inventory AOMEI software

    The tampering hit the update and notification flow used by AOMEI Backupper (seen on 8.3.0 and later); GTIG also describes AnyViewer relying on the same update flow.

    • List every endpoint with AOMEI Backupper or AnyViewer installed, including unmanaged or IT-tool installs
    • Note which ones were online between April and July 2026
  2. Step 2 of 5

    Sweep for file artifacts

    Executables never belong in AOMEI's html\ rendering folder.

    • Search AOMEI install paths html\ and Tmphtml\ for upgrade-now.exe or any other executable
    • Search %LOCALAPPDATA%\Radmin\ for BlkScrDl.dll, csvc\RuntimeComponent.dll, config.zip and metadata.dat
    • Search %LOCALAPPDATA%\Nitro Pro\ for Eztwain4.dll beside Nitro-named executables
    • Run the GTIG YARA rules and hash list across those hosts
  3. Step 3 of 5

    Check persistence and process history

    EDR history matters because the dropper self-deletes.

    • Look for scheduled tasks \RadminComponentRuntime and \NitroRuntime
    • Search process telemetry for --runtimechk or --nitrod, and for unsigned children of Backupper.exe or ABNotify.exe
    • Look for hidden-window PowerShell starting Nitro-named binaries
  4. Step 4 of 5

    Contain and rebuild

    Treat a hit as a remote-access backdoor with the privileges of the AOMEI process.

    • Isolate affected hosts and collect a forensic image before cleanup
    • Rebuild from a known-good baseline rather than deleting files
    • Rotate credentials used on or cached by the host
  5. Step 5 of 5

    Reduce future exposure

    The client didn't authenticate its remote config files, so the vendor's server fix doesn't change that design.

    • Disable AOMEI promotional and notification features where settings allow, or block the promo/notify hosts at the proxy if you don't need them
    • Alert on unsigned child processes of backup and update tools generally
    • Ask vendors whether update configs and packages are signature-verified, not just checksummed

Original content by ctxsec. Printable checklist: use your browser's print view.