The AOMEI supply chain attack used short-lived changes to vendor-hosted files to deliver malware through its Backupper software, researchers report. Attackers restored the original files within minutes, making subsequent checks appear normal.
ManageEngine’s Threat Analysis Lab investigated the campaign alongside Google’s Threat Intelligence Group and Mandiant. They attributed the activity to a threat actor tracked as UNC7017.
The reported campaign ran between April and July 2026. Researchers identified affected organizations across several countries, but the full extent of the compromise remains unknown.
Unexpected Remote Access Software Triggered Investigation
Researchers first detected suspicious activity on May 28, when AOMEI Backupper installed Radmin at two unrelated companies in different countries.
Radmin is a legitimate remote administration tool. However, its appearance raised concerns because Backupper’s promotional processes had launched the installation.
Those processes normally retrieve promotional material and notifications. Consequently, their involvement in installing remote access software prompted further investigation.
Initial attempts to reproduce the behavior failed. Instead, test systems contacted AOMEI’s servers and received legitimate configuration files.
Researchers later determined that the attackers changed the files only briefly before restoring their original contents.
Two Configuration Files Enabled Silent Malware Delivery
The attackers modified two files that supported Backupper’s promotional and notification features: down_html.ini and Notifycfg.ini.
The first directed the application to download a malicious ZIP archive. Meanwhile, the second used the notification mechanism to trigger execution without user interaction.
The attackers also changed the expected checksum in the download configuration. As a result, the malicious archive passed the application’s file verification checks.
Google subsequently reproduced the execution sequence in its own testing.
This approach exploited a trusted delivery path. Rather than persuading users to open an unrelated download, the attackers made installed backup software retrieve and launch the payload.
Malicious Files Appeared for Only Minutes
After the initial investigation failed to reproduce the attack, ManageEngine began continuously monitoring AOMEI’s servers.
On July 16, that monitoring captured malicious configuration changes as they happened. Researchers ultimately identified three confirmed exposure windows:
- May 28: 05:40–05:50 UTC, lasting 10 minutes.
- July 16: 08:33–08:39 UTC, lasting six minutes.
- July 20: 10:35–10:40 UTC, lasting five minutes.
After each window, the original configuration returned. Therefore, checks outside those periods could miss the malicious content entirely.
Google described the attacks as opportunistic. Additional organizations may have encountered the payloads if their software contacted the affected infrastructure during those brief intervals.
Known victims included organizations in the United States, Australia, India, Singapore, Spain and Switzerland. Affected sectors included IT services, telecommunications and higher education.
CROSSROAD and SHINYROAD Established Continued Access
The AOMEI supply chain attack distributed a previously unknown downloader called CROSSROAD and a backdoor named SHINYROAD.
CROSSROAD gathered information about infected computers, downloaded additional components and created a scheduled task to maintain persistence.
Meanwhile, SHINYROAD used legitimate Radmin components to load malicious code. It then established an outbound connection to attacker-controlled infrastructure.
That connection potentially allowed the attackers to issue further commands and deliver additional payloads.
During the July 20 activity, Google also observed an attempt to capture Windows authentication hashes. An invisible notification popup directed the software to an attacker-controlled WebDAV resource.
This could expose NTLM authentication material for collection and possible offline cracking. However, the report does not establish that attackers successfully recovered passwords.
Researchers Challenged the Initial Explanation
ManageEngine first notified AOMEI on June 7. The company initially suggested that someone might have intercepted and altered the content in transit.
However, researchers said their evidence did not support that explanation. The affected systems retrieved the content over HTTPS from AOMEI-owned hostnames across unrelated networks in different countries.
The malicious executable also arrived through Backupper’s own extraction process. Researchers therefore concluded that the alteration occurred within the vendor-hosted delivery path.
After capturing the July 16 activity, ManageEngine supplied AOMEI with the modified files, file comparisons and hashes. It also connected the company with Mandiant to support further investigation.
Server Changes Do Not Clean Previously Infected Computers
AOMEI later said its technical team had upgraded servers, patched potential vulnerabilities and checked the hosted files. Google also reported that AOMEI acknowledged corrective action on July 29.
Following publication of the findings, AOMEI said its chief technology officer was leading a high-priority investigation.
However, the company had not explained how attackers gained access or confirmed whether it had fully resolved the reported compromise.
ManageEngine also emphasized that securing the servers would not remove malware already installed on customer computers.
Organizations using Backupper should review the researchers’ published indicators of compromise. Relevant signs include suspicious scheduled tasks, unexpected executables inside AOMEI installation directories and connections to attacker-controlled infrastructure.
0 responses to “AOMEI Supply Chain Attack Used Brief Server Changes to Spread Malware”