Glossary term
Backdoor
A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.
Read more
Malware profile
SHINYROAD backdoor
SHINYROAD is the name Google Threat Intelligence Group and Mandiant give to a backdoor installed after a tampered AOMEI Backupper update in 2026.
In short
SHINYROAD is the name Google Threat Intelligence Group and Mandiant give to a backdoor installed after a tampered AOMEI Backupper update in 2026. It hides inside the files of a genuine remote administration tool and can run code that its operators send.
- Names1names in public reportsSHINYROAD
- Infection Steps5in the delivery chainTask runs · Library loaded
In one minute
- What it is
- A backdoor that Google Threat Intelligence Group and Mandiant name SHINYROAD, installed in the 2026 AOMEI Backupper update tampering.
- What it does
- It hides in the files of signed Radmin software, decrypts its code in memory and can run commands and new code from its operators.
- Who uses it
- Attributed by Google Threat Intelligence Group and Mandiant to a cluster they track as UNC7017. No government has named an actor in the sources we opened.
- How it gets in
- CROSSROAD installs it after a computer fetches a tampered AOMEI Backupper update.
- What to do first
- Check for the scheduled task RadminComponentRuntime and for an unsigned library loaded by the Radmin launcher.
What it does
SHINYROAD is the third stage of the chain that begins with the CROSSROAD downloader. Google and Mandiant say it abuses signed Radmin software: the signed Radmin launcher loads a harmful library placed next to it, a form of DLL hijacking.
That library registers a component that loads the real implant. ManageEngine says the implant decrypts its code in memory and runs it with an embedded interpreter. It describes a self-updating agent that talks to one fixed address over a plain network connection and can run commands and new code.
ManageEngine did not see a live session, because the control server did not answer during its tests. Its report calls what it saw a floor, not a ceiling. Read the AOMEI Backupper incident for the full story.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| SHINYROAD | Name for the backdoor in reports by Google Threat Intelligence Group and Mandiant, repeated by ManageEngine[1, 2] |
How it spreads
SHINYROAD is not spread on its own. CROSSROAD installs it after a computer fetched a tampered AOMEI Backupper update. A scheduled task then starts the Radmin launcher every three hours, which loads the harmful library.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Task runs
A scheduled task starts the signed Radmin launcher every three hours.[1, 2]
Library loaded
The launcher loads a harmful library placed beside it, found by search order.[1, 2]
Component registered
The library registers a component that runs inside a signed Windows host process.[2]
Code decrypted
The implant decrypts its code in memory and runs it with an embedded interpreter.[1, 2]
Contact home
The agent connects out to one fixed address, runs commands and can receive new code.[2]
Timeline
Seen in
Detection and defense
Watch outbound connections
ManageEngine suggests alerting on a connection to a high port with no earlier name lookup.[2]
Questions
What is SHINYROAD?
A backdoor named by Google Threat Intelligence Group and Mandiant, installed after a tampered AOMEI Backupper update in 2026.
How does it hide?
It uses signed Radmin software to load its own library, then decrypts its code in memory.
Did researchers see attackers use it?
ManageEngine did not see a live session because the control server did not answer in its tests.
Who is behind it?
Google and Mandiant track the activity as UNC7017. We found no government attribution.
Sources
- Investigating Ephemeral Supply Chain Tampering (15 October 2026) Google Threat Intelligence Group and MandiantSupports: UNC7017, CROSSROAD and SHINYROAD names, tampering windows, dropper behavior, scheduled task, vendor notification and response, hunting advice, ATT&CK list
- AOMEI Backupper Supply-Chain Compromise (16 October 2026) ManageEngine Threat Analysis LabSupports: Discovery, timeline, delivery through two unsigned configuration files, dropper checks, Radmin and side-loading, vendor statements, detection ideas
- Supply Chain Compromise: Compromise Software Supply Chain, T1195.002 MITRE ATT&CKSupports: Technique definition for the delivery through tampered software updates
- AOMEI Backupper changelog (latest version 8.5.0 listed) AOMEI TechnologySupports: Vendor page checked on 19 October 2026: no security notice about the tampering
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 54 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.