A series of calculated, short-burst supply chain compromises has targeted users of the popular AOMEI Backupper software, a widely utilized utility for Windows system backup, synchronization, and disk cloning. Between April and July, security researchers identified that attackers repeatedly tampered with the software\u2019s update mechanisms to distribute malicious payloads, including backdoors and remote access tools. The campaign, which represents a sophisticated shift in how threat actors approach software supply chain infiltration, has highlighted significant security gaps in how vendors verify the integrity of their update content.<\/p>\n
AOMEI Backupper boasts a massive footprint, with the developer claiming that its various free and paid editions\u2014which serve home users, small businesses, and enterprise-level Windows Server environments\u2014are utilized by more than 186 million individuals and organizations globally. Because of this scale, the software serves as a prime target for threat actors seeking to gain a foothold in diverse networks. The campaign, attributed to a threat actor tracked as UNC7017, exploited this trust by turning legitimate update channels into delivery vehicles for malware.<\/p>\n
Unlike traditional supply chain attacks, which typically involve a prolonged compromise of a developer\u2019s build pipeline or the insertion of malicious code into a software repository, this campaign utilized what security experts describe as "ephemeral tampering." Researchers from Google Cloud\u2019s Google Threat Intelligence Group (GTIG) and Mandiant, who collaborated with the ManageEngine Threat Analysis Lab (METAL) to uncover the activity, noted that the attackers favored speed and stealth over persistence on the server side.<\/p>\n
According to the joint findings, the windows of time during which the software was compromised were remarkably brief. "Each tampering window remained active for only five to ten minutes before reverting to authentic versions," the research teams reported. This extreme brevity was a deliberate tactical choice designed to minimize the likelihood of detection by security software and manual monitoring teams. By the time an administrator might have noticed an anomaly or a security alert was triggered, the server had often already reverted to its legitimate state, effectively erasing the evidence of the modification from the primary delivery channel.<\/p>\n
The opportunistic nature of the campaign meant that any system checking for updates during these narrow windows was susceptible to receiving a malicious package. Because the attack hit systems indiscriminately during these bursts, it was not restricted to a single industry or geographic region. Instead, the investigation uncovered evidence of compromised entities across a broad spectrum of sectors, including higher education, IT services, and telecommunications. Geographically, the impact was truly global, with affected organizations identified in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, T\u00fcrkiye, and the United States.<\/p>\n
The success of the UNC7017 group relied on abusing specific, insecure aspects of AOMEI Backupper\u2019s promotional and update content channels. These channels are designed to run background services that periodically poll AOMEI\u2019s servers for new content, configuration updates, or promotional material. The software architecture included two primary configuration paths intended to deliver and execute content in a local directory.<\/p>\n
Analysis from ManageEngine\u2019s METAL team revealed a critical vulnerability in this design: the lack of cryptographic authentication. The client software, which automatically processes these configuration files, failed to verify the authenticity or integrity of the files received from the server. Furthermore, the checksum used to validate the integrity of the downloaded archives was defined within the very same unauthenticated configuration file that named the archive. This effectively meant that an attacker who gained control over the configuration file could instruct the client to download a malicious archive, provide a matching checksum, and then execute the payload without triggering any security warnings on the user\u2019s machine.<\/p>\n
During the identified attack windows, UNC7017 manipulated these update settings files to redirect legitimate requests to malicious ZIP archives. Additionally, they modified the server\u2019s automatic notification service to force systems to execute the payloads immediately upon receipt, ensuring that the malware was installed without user intervention.<\/p>\n
The payloads delivered throughout the campaign were both modular and multifaceted. Researchers observed the deployment of several distinct components, including the CrossRoad downloader, a modified version of the Radmin Server remote administration tool, and the ShinyRoad modular backdoor framework.<\/p>\n
The initial infection stage typically involved the CrossRoad dropper. Once executed, this component performed essential system validation and cleanup tasks, effectively preparing the environment for the final-stage malware while simultaneously attempting to hide its tracks by deleting itself from the local disk. Following the successful staging of the environment, the attackers deployed ShinyRoad, a sophisticated modular backdoor that provided them with persistent control over the infected systems.<\/p>\n
As the campaign progressed into July, the threat actors began to incorporate additional tools to expand their capabilities. Specifically, they were observed deploying AdaptAgent, a component of the Adaptix C2 (Command-and-Control) framework, which is frequently used by sophisticated actors for post-exploitation activities.<\/p>\n
Perhaps the most innovative aspect of the campaign, however, was a secondary exploitation vector observed by Google Cloud researchers. To gain deeper access to network credentials, the attackers replaced a legitimate banner within the AOMEI client with a hidden, 1×1 pixel window. This window was configured with maximum execution priority, forcing the AOMEI client to initiate a remote resource request via the WebDAV protocol. This action was designed to leak NetNTLMv2 authentication hashes from the victim\u2019s machine directly to an attacker-controlled server, a classic "NTLM relay" technique that allows for unauthorized network authentication.<\/p>\n
The discovery of the UNC7017 campaign serves as a stark reminder of the evolving nature of software supply chain threats. Google Cloud researchers emphasized that this incident marks a transition from high-overhead, complex pipeline compromises to "lower-overhead, higher-stealth" alternatives. By targeting the configuration and delivery mechanisms rather than the source code itself, attackers can evade many of the static analysis tools that developers rely on to secure their software development life cycles.<\/p>\n
The incident also highlights the critical importance of secure communication between clients and update servers. The failure to implement cryptographic signing for configuration files is a significant security oversight, as it allows any entity capable of intercepting or modifying server traffic\u2014or gaining control over the server itself\u2014to weaponize the update process.<\/p>\n
The timeline of the disclosure revealed a concerning disconnect between the researchers and the vendor. ManageEngine\u2019s analysts first identified potential signs of tampering as early as late May. When they initially notified AOMEI Technology in early June, the vendor reportedly dismissed the findings, suggesting that the observed content modifications were likely the result of an interception in transit, rather than a compromise of their own infrastructure. It was only after subsequent notifications from Google Cloud in mid-July that the situation was escalated. AOMEI Technology eventually confirmed that it had taken corrective actions to secure its servers in late July.<\/p>\n
While the specific tampering windows identified in 2026 provided a window into the attacker’s methods, researchers remain concerned that the ephemeral nature of the campaign likely allowed for many other instances of tampering to go entirely unnoticed. For organizations and users relying on automated update mechanisms, the campaign underscores the necessity of robust endpoint detection and the importance of vendors maintaining rigorous, authenticated channels for all software and configuration distribution. As attackers continue to refine these stealthy, short-burst methods, the focus of supply chain security must broaden to include not just the integrity of the code, but the entire lifecycle of configuration and update delivery.<\/p>\n","protected":false},"excerpt":{"rendered":"
A series of calculated, short-burst supply chain compromises has targeted users of the popular AOMEI…<\/p>\n","protected":false},"author":25,"featured_media":2241,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[373],"tags":[1851,423,1852,374,445,368,1853,237,144,902,5,530,674,202],"class_list":["post-2242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bug-bounty-vulnerabilities","tag-aomei","tag-attacks","tag-backupper","tag-bug-bounty","tag-campaign","tag-chain","tag-ephemeral","tag-exploited","tag-hacking","tag-malware","tag-security","tag-sophisticated","tag-supply","tag-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2242"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2241"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}