Cybersecurity researchers have disclosed details of a supply chain compromise involving AOMEI Backupper, a Windows backup and disk cloning software, where attackers allegedly modified files on the vendor’s update servers for short periods to deliver a backdoor to systems checking for updates during those windows. The activity was identified by Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine Threat Analysis Lab, which reported that attackers repeatedly changed update-related files between May and July 2026. Systems running AOMEI Backupper that connected to the update servers during those brief periods could download and execute malicious files without requiring any additional user interaction. Researchers said AOMEI has taken corrective measures on its servers, but those actions do not automatically remove malware from systems that were previously affected.
AOMEI Backupper regularly communicates with vendor infrastructure through HTTPS to check for software updates and promotional notifications. Researchers found that two configuration files played a key role in this process. The down_html.ini file identifies the update package and the checksum used for verification, while Notifycfg.ini controls notification content and related execution behaviour. According to ManageEngine’s analysis, the software did not use cryptographic verification for these files, and the checksum information was stored inside the same unsigned file that identified the update package. Researchers said the incident did not involve exploitation of a software vulnerability within AOMEI Backupper itself. Instead, the attackers appeared to have gained the ability to modify files hosted on the vendor’s update infrastructure, allowing malicious content to be delivered through a trusted update mechanism.
GTIG and Mandiant identified three known periods of update tampering, including a 10 minute window on May 28, a six minute window on July 16, and a five minute window on July 20, 2026. Only systems that checked for updates during these periods were exposed, making detection more difficult because normal update activity before or after those periods would receive legitimate files. GTIG identified affected organisations across IT services, telecommunications, and higher education sectors in 11 countries, including Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. Researchers said the actual number of affected systems may be higher. The activity has been tracked by GTIG as UNC7017, although no specific country or known threat actor has been publicly linked to the operation.
On compromised systems, researchers observed a downloader called CROSSROAD that extracted files into a local Radmin folder, created scheduled tasks, and removed itself from the device. The package included a legitimate signed copy of Radmin, a commercial remote administration tool, along with an attacker-controlled DLL that loaded the SHINYROAD implant. The implant provided remote shell capabilities and allowed additional code to be downloaded and executed. Researchers also observed a later deployment involving the open-source Adaptix C2 framework disguised as Nitro PDF software. In another technique observed during the July 20 activity window, attackers modified notification settings to display an invisible pop-up that connected to an external WebDAV resource. This method could cause Windows to send NetNTLMv2 authentication responses to attacker-controlled infrastructure without requiring users to open a malicious file.
ManageEngine reported that its endpoint monitoring detected suspicious activity on May 28, when AOMEI Backupper appeared to install Radmin on customer systems in different countries. After further investigation, the company notified AOMEI and later observed additional evidence indicating that the modified content was being delivered through AOMEI’s own update process. Mandiant also notified AOMEI on July 17 and shared indicators linked to the activity. AOMEI informed Mandiant on July 29 that corrective action had been taken to secure its servers. However, researchers advised organisations using AOMEI software to investigate historical activity because server-side fixes do not remove existing infections. Security teams have been encouraged to review endpoint activity, scheduled tasks, cached update files, and network connections associated with the campaign to identify possible compromise.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
