Supply Chain Compromise: AOMEI Backupper Servers Exploited in Targeted Backdoor Campaign
Security researchers have uncovered a sophisticated and highly ephemeral supply chain attack targeting users of AOMEI Backupper, a widely used backup and recovery utility. Between April and July 2026, threat actors—tracked by Google as UNC7017—repeatedly compromised AOMEI’s infrastructure to push malicious payloads to unsuspecting endpoints. The campaign was notable for its extreme stealth, with attackers modifying configuration files on vendor servers for windows as brief as five to ten minutes before reverting them to their original state.
Tactics of the Compromise
The attackers leveraged the software’s legitimate update and promotional pop-up mechanisms to distribute malware. By altering critical configuration files, specifically down_html.ini and Notifycfg.ini, the threat actors redirected the application to pull malicious packages from attacker-controlled infrastructure. Because the attackers provided a matching checksum within these tampered files, the software’s native validation process erroneously accepted the malicious packages as legitimate updates.
Once a machine polled the server during one of the identified tampering windows—confirmed on May 28, July 16, and July 20—the software executed a dropper identified by Google researchers as CROSSROAD. This dropper performed environment checks, aborting if it detected specific security products or if the system was located in China. On vulnerable systems, it deployed the Radmin remote-administration tool alongside a custom backdoor dubbed SHINYROAD, which established persistence via a recurring scheduled task.
Credential Exposure and Impact
Beyond the installation of backdoors, the campaign demonstrated secondary objectives. During the July 20 window, attackers utilized the pop-up notification channel to force machines to authenticate against an attacker-controlled WebDAV server. This technique facilitated the silent harvesting of NetNTLMv2 password hashes from logged-in users, an action that required no active malware execution and could affect systems even where the primary dropper was successfully blocked by security software.
The victimology appears opportunistic, affecting IT services, telecommunications, and higher education sectors across a diverse geographic range, including the United States, Australia, South Africa, and several European nations. While AOMEI has confirmed that an investigation is underway under the direction of its CTO, the exact method used by UNC7017 to gain initial access to the vendor’s servers remains undisclosed.
Recommendations for Mitigation
Organizations currently utilizing AOMEI Backupper, or the AOMEI AnyViewer software which shares the same update architecture, are urged to conduct thorough forensic reviews. Security teams should cross-reference their environment logs against the indicators of compromise (IOCs) published by ManageEngine and Google to identify potential past exposure. Given the nature of the persistence mechanisms, including the use of Radmin and scheduled tasks, any identified compromise necessitates a full-scale incident response effort to ensure the removal of all backdoors and the rotation of potentially compromised credentials.
