AOMEI Update Servers Compromised to Distribute Malware and Backdoors
The infrastructure of AOMEI, a company specializing in backup and system recovery software, has been subjected to a stealthy supply chain attack. Hackers managed to manipulate configuration files on the update and notification servers for AOMEI Backupper to distribute malware without the users' knowledge.
The campaign was discovered by security research units from ManageEngine and Google Threat Intelligence Group, in addition to Mandiant. Reports indicated that the threat actor known as UNC7017 carried out precise attacks by temporarily manipulating configuration files on the company's servers, replacing them for only a few minutes before reverting them to their normal state to hide the traces of the attack.
Attack Details and Distribution Mechanism
The attackers exploited short, fleeting time windows in May and July 2026 to distribute modified configuration files that bypassed file integrity checks by altering checksum values. This manipulation caused the software to automatically download malicious content, including the remote management tool Radmin, a new loader known as CROSSROAD, and a backdoor dubbed SHINYROAD.
The campaign targeted various organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, spanning sectors such as information and communications technology and higher education. During the attacks, the attackers also attempted to steal Windows NTLM hashes by forcing the system to access WebDAV resources controlled by the attackers.
What Changes Practically?
Security entities confirmed that the fixes implemented by AOMEI on its servers and the updating of its systems contribute to preventing any new future infections. However, these measures do not remove the malware or backdoors that were already installed on user devices during the previous short exposure windows.
Important recommendations for affected organizations:
- Review the indicators of compromise published by security research teams.
- Inspect suspicious scheduled tasks on devices using the software.
- Verify the absence of unexpected executable files within the AOMEI Backupper installation paths.
- Monitor any outgoing network connections toward suspicious infrastructure identified in security reports.