UNC7017
0 reportsIntel LibraryUNC7017
Uncategorized threat cluster tracked by Google Threat Intelligence Group and Mandiant, responsible for an ephemeral supply chain compromise of AOMEI Backupper between April and July 2026, investigated with ManageEngine's Threat Analysis Lab (METAL). The actor briefly modified the down_html.ini and Notifycfg.ini configuration files on AOMEI's origin servers for windows of five to ten minutes, redirecting the update and promotion flow to an attacker-hosted archive, then restored them. It deployed the CROSSROAD downloader and the SHINYROAD backdoor through trojanized Radmin components, later Adaptix C2, and on one occasion coerced NetNTLMv2 authentication through a hidden WebDAV popup. Victims were opportunistic, in IT services, telecommunications and higher education across several countries. No state nexus has been stated.
Vendor aliases (1)
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | UNC7017 |
MITRE ATT&CK techniques (0)
No techniques mapped yet.
Indicators of compromise
No IOCs extracted yet from reports naming this actor.
Report timeline
Every report in the Global Intel Library that names UNC7017, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Threat feed IOCs (0)
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to UNC7017. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Public research & publications (2)
Open-source reports about this actor collected from MISP Galaxy.