AOMEI Backupper Hit by Ephemeral Supply Chain Attacks Delivering Sophisticated Malware

Widely used Windows backup and disk cloning software AOMEI Backupper was leveraged to distribute malware to its user base in a series of short-burst supply chain compromises between April and July, security researchers have warned.

AOMEI Backupper is a popular utility designed for Windows operating systems, offering backup, synchronization, and disk cloning capabilities for home users, enterprise environments, and Windows Server infrastructure. According to official figures published by AOMEI, the company’s software products are deployed by more than 186 million individuals and organizations worldwide.

Unlike traditional software supply chain attacks that typically involve long-term persistence within a developer’s build pipeline or the direct injection of malicious code into source code repositories, this sophisticated campaign relied on brief, ephemeral tampering windows. During these tightly controlled intervals, threat actors manipulated the software’s update mechanisms to serve malicious payloads before quickly reverting the servers to authentic versions.

The campaign was uncovered and analyzed by Google Cloud’s Google Threat Intelligence Group (GTIG) and Mandiant, working alongside the ManageEngine Threat Analysis Lab (METAL). Researchers tracked the activity cluster under the identifier UNC7017.

Short-Burst Tampering Evades Immediate Detection

The core mechanic of the UNC7017 campaign relied on what researchers call short-lived tampering windows. "Each tampering window remained active for only five to ten minutes before reverting to authentic versions," Google Cloud and Mandiant noted in a joint technical report investigating the supply chain compromise.

Because the compromised update configurations were rolled back almost as quickly as they were applied, the attacks hit virtually all systems that happened to fetch the modified AOMEI Backupper packages during those precise operational windows. This rapid-fire, hit-and-run delivery model strongly suggests an opportunistic distribution campaign rather than a highly targeted, bespoke intrusion against specific high-value corporate networks.

Despite the opportunistic nature of the delivery, the campaign successfully compromised organizations across multiple industry sectors globally. Throughout the course of their investigation, Google Cloud identified confirmed compromises at higher education institutions, IT service providers, and telecommunications entities spanning a wide geographic footprint. Impacted organizations were located in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.

"We confirmed several tampering windows in 2026, alongside related malware samples observed in the wild starting in late April," Google Cloud stated. However, given the fleeting duration of these operational windows, researchers caution that it is highly probable additional tampering events occurred throughout the campaign that remained entirely outside their visibility.

Exploiting Promotional Content Channels and Unauthenticated Paths

During the brief attack windows, threat actors targeted AOMEI’s infrastructure by modifying the update server’s configuration files. Specifically, UNC7017 tampered with the update settings file to redirect user requests toward a malicious ZIP archive. Simultaneously, the attackers modified the server’s automatic notification service to force connected client systems into automatically downloading and executing the malicious payload without requiring user intervention.

Technical analysis conducted by ManageEngine’s Threat Analysis Lab revealed that the hackers abused AOMEI Backupper’s built-in promotional content channel for malware distribution. This internal channel runs background services that routinely poll AOMEI’s servers for promotional content. The architecture includes two distinct configuration paths that ultimately deliver content to a local directory and execute it.

"The two paths converge on the same location. One controls what lands in html; the other controls what can be executed from it," METAL explained in its breakdown of the incident. "Neither configuration file is cryptographically authenticated by the client, and the checksum used to validate the archive is declared inside the same unauthenticated file that names it."

The lack of robust client-side cryptographic validation and unauthenticated checksum declarations left the update workflow vulnerable to malicious manipulation. ManageEngine’s threat analysts first caught a glimpse of the potential attack path on May 28, and subsequently observed the change in payloads served by AOMEI in real time on July 16. Just a few days later, on July 20, the short-burst tampering methodology was independently intercepted and documented by Mandiant.

Multi-Stage Malware Delivery and Post-Exploitation Frameworks

Payload analysis conducted by the investigating security teams revealed a diverse and modular arsenal deployed by UNC7017. In several instances, the attackers delivered a legitimate version of the Radmin Server remote administration tool alongside a malicious Dynamic Link Library (DLL) file. This DLL was designed to be side-loaded through the legitimate binary, ultimately establishing a covert reverse TCP connection back to attacker-controlled command-and-control (C&C) infrastructure.

In addition to remote administration tools, Google Cloud researchers observed UNC7017 introducing a secondary exploitation vector. The threat actors replaced a legitimate UI banner with a 1-by-1 pixel window assigned maximum execution priority. This forced the AOMEI client application to request a remote resource via the WebDAV protocol, effectively leaking NetNTLMv2 authentication hashes directly to the attackers.

Throughout the various stages of the campaign, the threat actors cycled through multiple payloads, including the CrossRoad dropper, modified variants of Radmin Server, and the Adaptix command-and-control framework.

The CrossRoad dropper was observed performing comprehensive system validation, local cleanup, and payload staging. Its primary function was to establish persistence for the late-stage backdoor before securely deleting itself from the host disk to minimize forensic artifacts. The final stage payload deployed across compromised environments was the ShinyRoad modular backdoor framework. Furthermore, in July, following the successful deployment of ShinyRoad, UNC7017 was observed dropping AdaptAgent, a functional component of the Adaptix C2 post-exploitation framework.

Security researchers emphasize that this campaign marks a notable shift in the threat landscape. "This campaign highlights a broader evolution in software supply chain attack methodologies," Google Cloud noted. "Supply chain intrusions have historically focused on inserting backdoors into software source code or tampering with developer build pipelines. UNC7017’s use of ephemeral configuration tampering represents a lower-overhead, higher-stealth alternative."

Vendor Response and Disclosure Timeline

The disclosure process involved multiple security entities and highlighted initial friction regarding the attribution of the compromise. According to ManageEngine’s threat intelligence team, METAL initially notified AOMEI Technology of potential infrastructure tampering and unauthorized modifications in early June. However, the vendor reportedly dismissed the report at the time, claiming that the observed content was likely intercepted and modified in transit rather than originating from compromised server infrastructure.

Following further intelligence gathering and independent confirmation, Google Cloud formally notified AOMEI Technology again in mid-July. By late July, the software vendor acknowledged the reports and confirmed that it had taken corrective actions to secure its update servers and close the configuration vulnerabilities exploited by UNC7017.