SHINYROADSHINYROAD

Modular Windows backdoor reported by Google Threat Intelligence Group and Mandiant in UNC7017's ephemeral supply chain compromise of AOMEI Backupper. It runs compiled Python bytecode inside an embedded PocketPy interpreter with custom C extensions, loaded through trojanized Famatech Radmin 3.x components: the signed FamItrfc.exe sideloads BlkScrDl.dll, which registers a COM in-process server that decrypts the bytecode with ChaCha20. It has no persistence of its own and relies on the CROSSROAD scheduled task. Command and control runs over raw TCP with an agent identifier derived from host and user names, and offers remote shell, traffic chaffing and in-memory extension loading.