---
title: AOMEI update-channel compromise: retro-hunt April–July 2026 | ctxsec
url: https://ctxsec.com/playbooks/aomei-update-channel-retro-hunt
---

[← Playbooks](/playbooks)

# AOMEI update-channel compromise: retro-hunt April–July 2026

Find and clean endpoints that may have received UNC7017's CROSSROAD/SHINYROAD payload through AOMEI Backupper's promotional update flow. Based on the GTIG/Mandiant and ManageEngine reports of Oct 15–16, 2026.

For: Security lead, SOC / threat hunter, Endpoint admin

[1. Inventory AOMEI software](#s1)[2. Sweep for file artifacts](#s2)[3. Check persistence and process history](#s3)[4. Contain and rebuild](#s4)[5. Reduce future exposure](#s5)

-

Step 1 of 5

__

### Inventory AOMEI software

The tampering hit the update and notification flow used by AOMEI Backupper (seen on 8.3.0 and later); GTIG also describes AnyViewer relying on the same update flow.

- List every endpoint with AOMEI Backupper or AnyViewer installed, including unmanaged or IT-tool installs
- Note which ones were online between April and July 2026
-

Step 2 of 5

__

### Sweep for file artifacts

Executables never belong in AOMEI's html\ rendering folder.

- Search AOMEI install paths html\ and Tmphtml\ for upgrade-now.exe or any other executable
- Search %LOCALAPPDATA%\Radmin\ for BlkScrDl.dll, csvc\RuntimeComponent.dll, config.zip and metadata.dat
- Search %LOCALAPPDATA%\Nitro Pro\ for Eztwain4.dll beside Nitro-named executables
- Run the GTIG YARA rules and hash list across those hosts
-

Step 3 of 5

__

### Check persistence and process history

EDR history matters because the dropper self-deletes.

- Look for scheduled tasks \RadminComponentRuntime and \NitroRuntime
- Search process telemetry for --runtimechk or --nitrod, and for unsigned children of Backupper.exe or ABNotify.exe
- Look for hidden-window PowerShell starting Nitro-named binaries
-

Step 4 of 5

__

### Contain and rebuild

Treat a hit as a remote-access backdoor with the privileges of the AOMEI process.

- Isolate affected hosts and collect a forensic image before cleanup
- Rebuild from a known-good baseline rather than deleting files
- Rotate credentials used on or cached by the host
-

Step 5 of 5

__

### Reduce future exposure

The client didn't authenticate its remote config files, so the vendor's server fix doesn't change that design.

- Disable AOMEI promotional and notification features where settings allow, or block the promo/notify hosts at the proxy if you don't need them
- Alert on unsigned child processes of backup and update tools generally
- Ask vendors whether update configs and packages are signature-verified, not just checksummed

Original content by ctxsec. Printable checklist: use your browser's print view.