SHINYROAD is the name Google Threat Intelligence Group and Mandiant give to a backdoor installed after a tampered AOMEI Backupper update in 2026. It hides inside the files of a genuine remote administration tool and can run code that its operators send.
What it does
SHINYROAD is the third stage of the chain that begins with the CROSSROAD downloader. Google and Mandiant say it abuses signed Radmin software: the signed Radmin launcher loads a harmful library placed next to it, a form of DLL hijacking.
That library registers a component that loads the real implant. ManageEngine says the implant decrypts its code in memory and runs it with an embedded interpreter. It describes a self-updating agent that talks to one fixed address over a plain network connection and can run commands and new code.
ManageEngine did not see a live session, because the control server did not answer during its tests. Its report calls what it saw a floor, not a ceiling. Read the AOMEI Backupper incident for the full story.
Names
Public sources use several names for this malware.
How it spreads
SHINYROAD is not spread on its own. CROSSROAD installs it after a computer fetched a tampered AOMEI Backupper update. A scheduled task then starts the Radmin launcher every three hours, which loads the harmful library.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Task runs
A scheduled task starts the signed Radmin launcher every three hours.[1, 2]
Library loaded
The launcher loads a harmful library placed beside it, found by search order.[1, 2]
Component registered
The library registers a component that runs inside a signed Windows host process.[2]
Code decrypted
The implant decrypts its code in memory and runs it with an embedded interpreter.[1, 2]
Contact home
The agent connects out to one fixed address, runs commands and can receive new code.[2]
Timeline
Seen in
Detection and defense
Watch outbound connections
ManageEngine suggests alerting on a connection to a high port with no earlier name lookup.[2]
Frequently Asked Questions
What is SHINYROAD?
A backdoor named by Google Threat Intelligence Group and Mandiant, installed after a tampered AOMEI Backupper update in 2026.
How does it hide?
It uses signed Radmin software to load its own library, then decrypts its code in memory.
Did researchers see attackers use it?
ManageEngine did not see a live session because the control server did not answer in its tests.
Who is behind it?
Google and Mandiant track the activity as UNC7017. We found no government attribution.
Sources
- Investigating Ephemeral Supply Chain Tampering (15 October 2026)Google Threat Intelligence Group and Mandiant · Supports: UNC7017, CROSSROAD and SHINYROAD names, tampering windows, dropper behavior, scheduled task, vendor notification and response, hunting advice, ATT&CK list
- AOMEI Backupper Supply-Chain Compromise (16 October 2026)ManageEngine Threat Analysis Lab · Supports: Discovery, timeline, delivery through two unsigned configuration files, dropper checks, Radmin and side-loading, vendor statements, detection ideas
- Supply Chain Compromise: Compromise Software Supply Chain, T1195.002MITRE ATT&CK · Supports: Technique definition for the delivery through tampered software updates
- AOMEI Backupper changelog (latest version 8.5.0 listed)AOMEI Technology · Supports: Vendor page checked on 19 October 2026: no security notice about the tampering
