AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

What it is

AOMEI Backupper, Windows backup, sync and disk cloning software, served malware to users in short tampering windows between April and July 2026. Google Threat Intelligence Group (GTIG), Mandiant and the ManageEngine Threat Analysis Lab (METAL) attribute the campaign to UNC7017. AOMEI says its products have more than 186 million users.

How it works

The attackers did not touch source code or build pipelines. They briefly altered content on AOMEI's servers, then let it revert to the genuine versions.

METAL traced the abuse to the client's promotional content channel. Background services poll AOMEI servers and use two configuration paths: one controls what lands in the html\ directory, the other controls what can be executed from it. METAL states that neither configuration file is cryptographically authenticated by the client. The checksum used to validate the archive is declared inside the same unauthenticated file that names the archive, so it proves nothing.

UNC7017 changed the update settings file to point to a malicious ZIP archive. It also changed the automatic notification service so clients ran the content. Payloads seen:

• CrossRoad dropper: validates the system, stages payloads, sets persistence for the backdoor, then deletes itself.
• ShinyRoad modular backdoor: the final payload.
• A legitimate Radmin Server with a malicious DLL loaded through it, which opens a reverse TCP connection to the attackers' command-and-control server.
• AdaptAgent from the Adaptix C2 framework, dropped in July after ShinyRoad was deployed.

A second vector replaced a legitimate banner with a 1×1 pixel window at maximum execution priority. It forced the client to request a remote resource over WebDAV, which sent NetNTLMv2 hashes to the attackers.

Preconditions / Affected

Any system that fetched the modified packages during a window was hit, which suggests opportunistic rather than targeted activity. Google Cloud confirmed compromised higher education, IT services and telecommunications organisations in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States.

What to do

The page gives no indicators of compromise, commands or detections, and names no fixed client version. Reasonable scoping from the stated facts: check AOMEI Backupper hosts for the named payloads (CrossRoad, ShinyRoad, Radmin Server with an unexpected DLL, AdaptAgent) and for outbound WebDAV requests. Treat NetNTLMv2 hashes from affected hosts as exposed. The full GTIG and METAL reports are the source for indicators.

Caveats

• Google Cloud says additional tampering probably occurred outside its visibility.
• Confirmed timeline: METAL saw a potential attack path on 28 May 2026 and observed the payload change live on 16 July. Mandiant caught the tampering on 20 July.
• METAL notified AOMEI in early June, and the vendor dismissed it as likely in-transit interception. After a second notice from Google Cloud in mid-July, AOMEI said in late July that it had taken corrective actions. The page does not say what they were.