Hackers hijack AOMEI update servers in brief supply chain attacks

Researchers uncover compromise distributing malware through backup software’s promotional feature

By LineZotpaper

Published19 October 2026

Read Time3 min

A threat actor tracked as UNC7017 briefly compromised AOMEI’s update infrastructure between April and July 2026, using the software’s built-in promotional feature to distribute malware to organisations across multiple sectors and countries. The attacks, which relied on short windows of tampering with configuration files, were uncovered by researchers at ManageEngine’s Threat Analysis Lab working with Google’s Threat Intelligence Group and Mandiant.

According to reports from Google and ManageEngine, the supply chain attacks targeted AOMEI Backupper, a Windows application used for backing up data and cloning disks. The attackers modified two configuration files – down_html.ini and Notifycfg.ini – that control where the software downloads update packages and how it displays notifications. By altering these files for a few minutes at a time, they redirected the software to download malicious ZIP archives and used the notification mechanism to execute the malware without user interaction.

Three exposure windows were identified: May 28 (10 minutes), July 16 (6 minutes) and July 20 (5 minutes). Malware delivered included CROSSROAD, a downloader that performed reconnaissance and established persistence, and SHINYROAD, a backdoor that used the legitimate remote administration tool Radmin to load malicious code and connect to attacker-controlled servers. During the July 20 window, Google observed a technique attempting to steal Windows authentication hashes via a WebDAV resource.

The attacks were first detected on May 28 when ManageEngine’s endpoint security software flagged AOMEI Backupper installing Radmin on computers at two unrelated companies in different countries. After failing to reproduce the behaviour, researchers began continuous monitoring of AOMEI’s servers and captured the malicious modifications directly on July 16. The attackers restored the configuration files to their original state within minutes, making the compromise hard to detect.

Affected organisations were identified in the United States, Australia, India, Singapore, Spain and Switzerland, across sectors including IT services, telecommunications and higher education. Google warned the attacks were opportunistic and could have affected additional organisations that checked for updates during the brief windows.

ManageEngine notified AOMEI about the suspicious activity on June 7. AOMEI initially suggested the content may have been intercepted while in transit, an explanation the researchers dismissed. “The evidence did not support AOMEI’s explanation of interception in transit,” the ManageEngine report states. When further evidence was provided in July, AOMEI said its initial examination had not found a breach. After notification from Mandiant on July 17, AOMEI responded on July 29 saying it had taken corrective action, upgrading servers and patching vulnerabilities.

In a statement to BleepingComputer, AOMEI said it was treating the report as a high priority and that its chief technology officer was leading a dedicated investigation. The company did not confirm how attackers gained access to its infrastructure or whether the compromise had been fully resolved. ManageEngine warned that while a server-side fix stops new infections, “it does not remove the backdoor from machines that received it during an earlier window.”

Analysis

Why This Matters

The attacks demonstrate the difficulty of detecting supply chain compromises that last only a few minutes, as attackers restored configuration files quickly each time.
Organisations using AOMEI Backupper may remain compromised if they were infected during the exposure windows, raising follow-up and remediation concerns.
The breach of a trusted update mechanism shows how software distribution pipelines remain a vulnerable point of entry even for well-known tools.

Background

AOMEI Backupper is widely used for disk cloning and backups on Windows systems. Supply chain attacks that compromise legitimate update channels can be highly effective because software that users trust to be safe can deliver malware directly. This incident shares common patterns with other software supply chain compromises, but the brief tampering windows were an unusual attempt at stealth.

Key Perspectives

AOMEI: The company described the incident as a high priority and said its CTO was investigating. It claimed to have secured its servers and patched potential vulnerabilities, but did not disclose the root cause of the compromise. Researchers (ManageEngine, Google, Mandiant): They attribute the attacks to UNC7017 and emphasise that the infection could have spread further. They reject the suggestion that interception in transit was the cause and note that a server-side fix does not remove existing infections. Affected organisations and customers: Those who installed updates during the attack windows may have backdoored systems requiring forensic review. The stealthy nature of the compromise makes it difficult to determine the full scope of infections.

What to Watch

Whether AOMEI releases further details on the root cause and remediation steps for affected customers.
If additional organisations come forward confirming infections from the attack windows.
Potential follow-on activity from the threat actor, including use of the stolen NTLM hashes for further intrusions.

Sources

Hackers hijack AOMEI update servers to secretly spread malware · BleepingComputer

Checked

12 claims in this story checked against 1 source: 12 supported.

Show each claim

SupportedHackers hijack AOMEI update servers in brief supply chain attacksBleepingComputer: “Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.”
SupportedResearchers uncover compromise distributing malware through backup software’s promotional featureBleepingComputer: “Researchers at ManageEngine's Threat Analysis Lab (METAL), working with Google's Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks.”
SupportedA threat actor tracked as UNC7017 briefly compromised AOMEI’s update infrastructure between April and July 2026BleepingComputer: “the activity is attributed to a threat actor tracked as UNC7017, who used the compromised infrastructure to distribute... The supply chain attacks took place between April and July 2026”
SupportedThe attackers modified two configuration files – down_html.ini and Notifycfg.iniBleepingComputer: “the attackers briefly modified two configuration files used by the promotion and notification systems: https://www2.aomeisoftware.com/download/abpopup/down_html.ini https://account.aomeitech.com/Notifycfg.ini”
SupportedThree exposure windows were identified: May 28 (10 minutes), July 16 (6 minutes) and July 20 (5 minutes)BleepingComputer: “they identified three windows... May 28: 10-minute exposure window (05:40 – 05:50 UTC) July 16: 6-minute exposure window (08:33 – 08:39 UTC) July 20: 5-minute exposure window (10:35 – 10:40 UTC)”
SupportedMalware delivered included CROSSROAD, a downloader that performed reconnaissance and established persistence, and SHINYROAD, a backdoor that used the legitimate remote administration tool Radmin to load malicious codeBleepingComputer: “distribute a previously unknown malware downloader called CROSSROAD and a backdoor named SHINYROAD... the CROSSROAD downloader checked the performed reconnaissance on the infected computer, downloaded additional components, and established persistence through a scheduled task. SHINYROAD is a backdoor that used legitimate Radmin components to load malicious code and establish an outbound connection”
SupportedAffected organisations were identified in the United States, Australia, India, Singapore, Spain and SwitzerlandBleepingComputer: “identified affected organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland”
SupportedAffected sectors include IT services, telecommunications and higher educationBleepingComputer: “across sectors such as IT services, telecommunications, and higher education”
SupportedManageEngine notified AOMEI about the suspicious activity on June 7BleepingComputer: “ManageEngine told BleepingComputer that it first notified AOMEI about the suspicious activity on June 7”
Supported“The evidence did not support AOMEI’s explanation of interception in transit,” the ManageEngine report states.BleepingComputer: “"The evidence did not support AOMEI’s explanation of interception in transit," reads ManageEngine's report.”
Supported“it does not remove the backdoor from machines that received it during an earlier window.”BleepingComputer: “"A server-side fix stops new infections; it does not remove the backdoor from machines that received it during an earlier window," ManageEngine told BleepingComputer.”
SupportedThe company did not confirm how attackers gained access to its infrastructure or whether the compromise had been fully resolved.BleepingComputer: “AOMEI did not immediately confirm how attackers gained access to its update infrastructure or whether the reported compromise had been fully resolved.”