Loading threat actor…
UNC7017 is an unattributed threat actor tracked by Google Threat Intelligence Group for compromising the update-distribution mechanism of AOMEI Backupper, a Windows backup and disk-cloning application. Its observed campaign operated between May and July 2026 and affected organizations in IT services, telecommunications, and higher education across 11 countries. Targeting was characterized as opportunistic. No country affiliation, established actor identity, or dominant motivation has been confirmed. UNC7017 briefly replaced server-hosted update configuration files, redirecting installations checking for updates during those windows to malicious downloads. The operation exploited the application's failure to cryptographically authenticate update metadata rather than a documented software vulnerability. Execution required no additional user interaction and inherited the privileges of the launching AOMEI process. Restoring legitimate server content between tampering windows complicated detection and retrospective investigation. The CROSSROAD downloader established scheduled-task persistence and deployed the SHINYROAD backdoor through DLL side-loading involving a legitimate signed Radmin executable. SHINYROAD executes Python bytecode in memory, provides a remote shell, and downloads and executes additional payloads. Its command-and-control communications use encryption and randomized junk packets to impede network detection. CROSSROAD also employed geographic and security-tool execution checks, restored legitimate local update content, and deleted itself. Some compromised systems subsequently received Adaptix C2 payloads, including ADAPTAGENT, deployed using Nitro PDF-themed disguises and additional DLL side-loading. UNC7017 also modified promotional configuration content to display an invisible WebDAV-linked pop-up intended to coerce Windows into transmitting the logged-in user's NetNTLMv2 authentication response. This credential-capture attempt did not require execution of a separate malicious program.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.