AOMEI Backupper (and AnyViewer) update server tampered by UNC7017, April-July 2026: CrossRoad / ShinyRoad backdoor and Radmin delivered through in-app updates. Was my PC hit and what do I do?

What happened: Google reported, and AOMEI confirmed, that the threat actor UNC7017 repeatedly altered configuration files on AOMEI's update infrastructure between April and July 2026. Each change lasted only five to ten minutes. Computers whose AOMEI software checked for updates during one of those windows were sent to a malicious download, which installed a legitimate Radmin Server remote-administration tool with a malicious DLL, the CrossRoad downloader and the ShinyRoad backdoor. The configuration files weren't cryptographically protected, so the attacker could change both the download address and the checksum. Victims included universities, IT service providers and telecom companies in many countries. AOMEI lists three confirmed windows (UTC): May 28 05:40-05:50, July 16 08:33-08:39 and July 20 10:35-10:40. Researchers say samples go back to late April. Am I affected: - Windows machines running AOMEI Backupper (and, per researchers, AnyViewer) with automatic or in-app update checks between April and July 2026. Machines that didn't check during a window got legitimate content. - Signs to look for: Radmin Server (rserver3.exe or a Radmin service) that nobody installed on purpose, unknown DLLs beside it, new services or scheduled tasks created around those dates, and outbound connections from the machine to unfamiliar hosts. Check EDR or antivirus alerts for CrossRoad, ShinyRoad or Adaptix detections. Fix: 1. Update AOMEI Backupper to 8.5.1 or later (released October 19, 2026). AOMEI says it disabled the affected update mechanism, signs its remote configuration, and stopped using the www2.aomeisoftware.com download domain. 2. Run AOMEI's security scanner from its official statement page and a full scan with up-to-date antivirus or EDR. 3. If you find Radmin or any detection: isolate the machine, remove the implant or reimage it, and rotate passwords and keys used on or stored on that machine (domain, VPN, backup destinations, browsers). On servers and admin workstations, assume the attacker could move laterally and investigate accordingly. After: block the old download domain at your DNS or proxy, keep in-app updaters on software you depend on under watch, and prefer updates delivered through your own software-management tools. Sources: https://www.aomeitech.com/company/investigating-ephemeral-tampering.html https://www.securityweek.com/aomei-backupper-compromised-in-short-burst-supply-chain-campaign/ https://fieldeffect.com/blog/aomei-backupper-supply-chain-attack