Glossary term
Backdoor
A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.
Read more
Malware profile
CROSSROAD downloader
Also known as upgrade-now
CROSSROAD is the name Google Threat Intelligence Group and Mandiant give to a downloader used in a 2026 tampering of AOMEI Backupper updates.
In short
CROSSROAD is the name Google Threat Intelligence Group and Mandiant give to a downloader used in a 2026 tampering of AOMEI Backupper updates. It ran on a computer when the backup program fetched a tampered update, then set up a backdoor that they name SHINYROAD.
- Names2names in public reportsCROSSROAD · upgrade-now
- Infection Steps6in the delivery chainUpdate check · Dropper starts
In one minute
- What it is
- A downloader that Google Threat Intelligence Group and Mandiant name CROSSROAD. It arrived inside a tampered AOMEI Backupper update and set up a backdoor.
- What it does
- It checked the computer's location, downloaded a Radmin-based package, created a scheduled task that ran every three hours, and deleted itself.
- Who uses it
- Attributed by Google Threat Intelligence Group and Mandiant to a cluster they track as UNC7017. No government has named an actor in the sources we opened.
- How it gets in
- Tampered update files fetched by AOMEI Backupper from the vendor's update servers during short windows in 2026.
- What to do first
- Look for the scheduled task named RadminComponentRuntime and an unexpected Radmin install. Treat any hit as a full compromise.
What it does
CROSSROAD is a small 64-bit Windows program. Google and Mandiant say it checked where the computer was before doing anything else. If the country was China, it stopped its main path. ManageEngine adds that it also stopped when location lookups failed or when certain security agents were present.
On computers that passed the checks it downloaded more files, installed the Radmin remote administration tool (ManageEngine calls it the genuine Radmin Server; Google says the 28 May wave installed a modified Radmin Server) and created a scheduled task that ran every three hours. It then removed itself. The backdoor that this task loads is described on our SHINYROAD page. The incident is covered in the AOMEI Backupper update tampering page.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| CROSSROAD | Name for the downloader in reports by Google Threat Intelligence Group and Mandiant, repeated by ManageEngine[1, 2] |
| upgrade-now | Name of the unsigned program file the dropper used, in both reports[1, 2] |
How it spreads
CROSSROAD did not spread by itself. Attackers briefly changed the configuration files that AOMEI Backupper reads from its own update servers. During those windows of 5 to 10 minutes, a copy of the program that checked for updates was pointed to attacker files. Google and Mandiant say the windows seen on 28 May, 16 July and 20 July 2026 ended when the files returned to the real versions.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Update check
AOMEI Backupper asks the vendor's servers for its update settings. During a tampering window those settings point to attacker files.[1, 2]
Dropper starts
An unsigned program with AOMEI-looking details is started from the application's own folder.[1, 2]
Checks
It stops its main path if the public address is located in China, and ManageEngine adds that it also stops if the lookup fails or certain security agents are present.[1, 2]
Package fetched
It downloads more files and installs Radmin software. ManageEngine calls it the genuine Radmin Server, while Google says the 28 May wave installed a modified Radmin Server.[1, 2]
Task created
It creates the scheduled task RadminComponentRuntime, which runs every three hours.[1, 2]
Self delete
It removes itself using a file stream trick, and undoes the setting change it relied on.[1, 2]
Timeline
- 28 May 2026
- 7 June 2026
Vendor told
ManageEngine says it raised the alert with AOMEI the same day it heard from a customer.[2]
- 16 July 2026
- 17 July 2026
Google informs
Mandiant notifies AOMEI and shares indicators, Google says.[1]
- 20 July 2026
- 29 July 2026
Vendor reply
Google says AOMEI replied that it had taken corrective action.[1]
- 15 and 16 October 2026
Seen in
Detection and defense
Do not trust a live check
Do not test an alert by fetching the vendor's update address now. Google says it returns clean files most of the time. Keep the application's staging and html folders and review proxy logs for the alert time.[1]
Block unneeded outbound traffic
Google lists blocking outbound SMB (port 445) and WebDAV to outside addresses.[1]
Questions
What is CROSSROAD?
The name Google Threat Intelligence Group and Mandiant give to the downloader used in the 2026 AOMEI Backupper update tampering.
How did CROSSROAD get onto computers?
Through tampered update files that AOMEI Backupper fetched from the vendor's servers during windows of 5 to 10 minutes.
Does CROSSROAD run in China?
Google says it ended its main path when the location was China.
Is the problem gone now that AOMEI fixed its servers?
No. Google says the fix does not clean computers that already ran the file, so they should be checked.
Who is behind it?
Google and Mandiant track the activity as UNC7017. We found no government attribution.
Sources
- Investigating Ephemeral Supply Chain Tampering (15 October 2026) Google Threat Intelligence Group and MandiantSupports: UNC7017, CROSSROAD and SHINYROAD names, tampering windows, dropper behavior, scheduled task, vendor notification and response, hunting advice, ATT&CK list
- AOMEI Backupper Supply-Chain Compromise (16 October 2026) ManageEngine Threat Analysis LabSupports: Discovery, timeline, delivery through two unsigned configuration files, dropper checks, Radmin and side-loading, vendor statements, detection ideas
- Supply Chain Compromise: Compromise Software Supply Chain, T1195.002 MITRE ATT&CKSupports: Technique definition and mitigations
- AOMEI Backupper changelog (latest version 8.5.0 listed) AOMEI TechnologySupports: Vendor page checked on 19 October 2026: no security notice about the tampering
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 54 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.