AOMEI Backupper updates briefly served malware in 2026
Original title: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
Google Threat Intelligence Group, Mandiant, and ManageEngine’s METAL say AOMEI Backupper’s update channel was tampered with between April and July 2026. UNC7017 changed unauthenticated configuration so clients downloaded a malicious archive and executed it, delivering CrossRoad, a modified Radmin Server, ShinyRoad, and later AdaptAgent from the Adaptix C2 framework. A second vector used a 1×1 banner and WebDAV to collect NetNTLMv2 hashes. Confirmed victims span higher education, IT services, and telecommunications in 11 countries. AOMEI initially dismissed a June notice, then said in late July it had taken corrective action.
Unconfirmed: Google says additional tampering was probable but unseen; AOMEI first claimed the content was modified in transit.
- AOMEI says its products are used by more than 186 million people.
- Each observed tampering window lasted five to ten minutes before authentic packages returned.
- Clients did not cryptographically authenticate the configuration or archive checksum.
- Researchers saw payload changes on May 28, July 16, and July 20.
- Google says more short windows likely fell outside its visibility.
Impact: Downloader, backdoor, and NetNTLMv2 hashes via updates
| Product | Affected |
|---|---|
| AOMEI Technology AOMEI Backupper | — |
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1187 Forced AuthenticationT1219 Remote Access Tools
- Vendors
- AOMEI Technology
- Products
- AOMEI BackupperRadmin Server
- Threat actors
- UNC7017
From the original article
3 min read at securityweek.com
Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework. The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.