It ran on a computer when the backup program fetched a tampered update, then set up a backdoor that they name SHINYROAD.
What it does
CROSSROAD is a small 64-bit Windows program. Google and Mandiant say it checked where the computer was before doing anything else. If the country was China, it stopped its main path. ManageEngine adds that it also stopped when location lookups failed or when certain security agents were present.
On computers that passed the checks it downloaded more files, installed the Radmin remote administration tool (ManageEngine calls it the genuine Radmin Server; Google says the 28 May wave installed a modified Radmin Server) and created a scheduled task that ran every three hours. It then removed itself. The backdoor that this task loads is described on our SHINYROAD page. The incident is covered in the AOMEI Backupper update tampering page.
Names
Public sources use several names for this malware.
How it spreads
CROSSROAD did not spread by itself. Attackers briefly changed the configuration files that AOMEI Backupper reads from its own update servers. During those windows of 5 to 10 minutes, a copy of the program that checked for updates was pointed to attacker files. Google and Mandiant say the windows seen on 28 May, 16 July and 20 July 2026 ended when the files returned to the real versions.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Update check
AOMEI Backupper asks the vendor's servers for its update settings. During a tampering window those settings point to attacker files.[1, 2]
Dropper starts
An unsigned program with AOMEI-looking details is started from the application's own folder.[1, 2]
Checks
It stops its main path if the public address is located in China, and ManageEngine adds that it also stops if the lookup fails or certain security agents are present.[1, 2]
Package fetched
It downloads more files and installs Radmin software. ManageEngine calls it the genuine Radmin Server, while Google says the 28 May wave installed a modified Radmin Server.[1, 2]
Task created
It creates the scheduled task RadminComponentRuntime, which runs every three hours.[1, 2]
Self delete
It removes itself using a file stream trick, and undoes the setting change it relied on.[1, 2]
Timeline
- 28 May 2026
- 7 June 2026
Vendor told
ManageEngine says it raised the alert with AOMEI the same day it heard from a customer.[2]
- 16 July 2026
- 17 July 2026
Google informs
Mandiant notifies AOMEI and shares indicators, Google says.[1]
- 20 July 2026
- 29 July 2026
Vendor reply
Google says AOMEI replied that it had taken corrective action.[1]
- 15 and 16 October 2026
Seen in
Detection and defense
Do not trust a live check
Do not test an alert by fetching the vendor's update address now. Google says it returns clean files most of the time. Keep the application's staging and html folders and review proxy logs for the alert time.[1]
Block unneeded outbound traffic
Google lists blocking outbound SMB (port 445) and WebDAV to outside addresses.[1]
Frequently Asked Questions
What is CROSSROAD?
The name Google Threat Intelligence Group and Mandiant give to the downloader used in the 2026 AOMEI Backupper update tampering.
How did CROSSROAD get onto computers?
Through tampered update files that AOMEI Backupper fetched from the vendor's servers during windows of 5 to 10 minutes.
Does CROSSROAD run in China?
Google says it ended its main path when the location was China.
Is the problem gone now that AOMEI fixed its servers?
No. Google says the fix does not clean computers that already ran the file, so they should be checked.
Who is behind it?
Google and Mandiant track the activity as UNC7017.
Sources
- Investigating Ephemeral Supply Chain Tampering (15 October 2026)Google Threat Intelligence Group and Mandiant · Supports: UNC7017, CROSSROAD and SHINYROAD names, tampering windows, dropper behavior, scheduled task, vendor notification and response, hunting advice, ATT&CK list
- AOMEI Backupper Supply-Chain Compromise (16 October 2026)ManageEngine Threat Analysis Lab · Supports: Discovery, timeline, delivery through two unsigned configuration files, dropper checks, Radmin and side-loading, vendor statements, detection ideas
- Supply Chain Compromise: Compromise Software Supply Chain, T1195.002MITRE ATT&CK · Supports: Technique definition and mitigations
