A sophisticated supply chain attack targeting AOMEI Technology’s Backupper software — used by over 100 million people worldwide — has been uncovered by Google’s Threat Intelligence Group (GTIG) and Mandiant. The threat actor, tracked as UNC7017, repeatedly tampered with AOMEI’s update servers in windows as brief as five minutes, just long enough to push a backdoor to machines checking for updates before restoring the clean configuration. The campaign ran from April through late July 2026, and infected endpoints remain compromised even after the servers were remediated.
What Happened
Rather than exploiting a vulnerability in the software itself, UNC7017 went after AOMEI’s update infrastructure. The desktop client for Backupper and its companion remote-access tool AnyViewer relies on two remote configuration files — down_html.ini and Notifycfg.ini — to check for new versions. Crucially, the client did not cryptographically verify these files. If an attacker could modify them on the server, the software would trust whatever instructions they contained.
That is exactly what UNC7017 did. By altering the configuration files, the attackers redirected update checks to a malicious ZIP archive (upgrade-now.zip) containing a 64-bit C downloader called CROSSROAD. Because the same configuration file supplied both the download URL and the expected MD5 checksum the client used for verification, the attacker could change both the payload and the information the software relied on to accept it. As Malwarebytes researcher Pieter Arntz put it, the attackers “could change both the download and the information the software used to accept it.”
The 5-Minute Playbook
What makes this attack particularly notable is its brevity. Researchers confirmed at least three tampering windows: a 10-minute window on May 28, a 6-minute window on July 16, and a 5-minute window on July 20. The attacker altered the configuration, waited for a small number of machines to pull the malicious update, then restored the clean files. This hit-and-run tactic kept the infection count low enough to avoid detection while still delivering the payload to opportunistic victims.
On July 16, UNC7017 refined its approach by injecting over 35,000 dummy lines into Notifycfg.ini. This was not random padding — it was a calculated move to bypass local version checks in the client, forcing the software to treat the file as genuinely new and execute the payload immediately.
A Multi-Stage Payload
Once executed, the CROSSROAD downloader kicked off a carefully sequenced infection chain. It first restored the clean configuration files to cover its tracks, then unpacked a legitimate Famatech Radmin 3.x remote-administration utility and created a scheduled task named RadminComponentRuntime set to run every three hours. After that, CROSSROAD deleted itself.
The persistence came through DLL sideloading: the legitimate Radmin binary loaded a malicious library (BlkScrDl.dll) that ran the SHINYROAD backdoor entirely in memory using an embedded PocketPy interpreter. Running in memory and hiding behind a signed binary made the backdoor particularly difficult for endpoint security tools to flag.
By mid-July, UNC7017 added more tools to its arsenal. The Adaptix command-and-control framework appeared disguised as a Nitro PDF tool, and a nearly invisible one-pixel browser popup was deployed to steal NetNTLMv2 credential hashes via WebDAV — a technique that could enable lateral movement within corporate networks.
Who Was Hit
While the exact number of infected machines has not been disclosed, GTIG confirmed victims across a wide geographic spread: IT services, telecommunications, and higher-education organizations in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. The victimology appeared largely opportunistic — whoever happened to check for an update during those narrow windows was at risk.
One telling behavioral marker: the malware checks the victim machine’s external IP address and halts execution if it resolves to China. While researchers have not formally attributed UNC7017 to a specific nation-state, this geo-fencing is a pattern commonly seen in campaigns originating from or aligned with Chinese interests.
Discovery and Response
ManageEngine’s Threat Analysis Lab (METAL) first spotted anomalous activity in late May 2026. GTIG and Mandiant subsequently led a deeper investigation. On July 17, Mandiant formally notified AOMEI Technology, and by July 29 the company confirmed that its servers had been remediated.
However, fixing the update servers does not clean machines that were already compromised. Endpoints that pulled the malicious payload during any of those brief windows may still be running the SHINYROAD backdoor, the Adaptix framework, or both. The attacker’s scheduled tasks ensure persistence across reboots, and the use of legitimate binaries for sideloading makes detection harder without targeted hunting.
What You Should Do
If your organization uses AOMEI Backupper or AnyViewer, these steps are essential:
- Hunt for persistence: Check Windows Task Scheduler for tasks named
RadminComponentRuntimeorNitroRuntime. Their presence is a strong indicator of compromise. - Check for artifacts: Look in your AOMEI installation folder — particularly the
htmlandTmphtmlsubdirectories — for any unsignedupgrade-now.exeor unexpectedupgrade-now.zipfiles, though the downloader deletes itself after execution. - Block known infrastructure: Add
storage-data.com,promotion.storage-data.com,aomei.storage-data.com, and the IPs8.210.84.56,47.239.60.117, and8.218.65.184to your network blocklists. - Restrict outbound SMB and WebDAV: The NetNTLMv2 hash theft relies on outbound SMB traffic to attacker-controlled servers. Blocking or monitoring this traffic is a straightforward mitigation.
- Run a full scan: Update your endpoint protection and perform a thorough scan. Malwarebytes detects the downloader as
Malware.AI.4006642887.
The Bigger Picture
This attack underscores a growing trend: threat actors are increasingly targeting software update mechanisms rather than the software itself. The approach is devastatingly efficient — users trust updates implicitly, and a compromised update channel delivers malware directly into environments that security teams may consider already vetted. The SolarWinds attack of 2020 brought this vector into the spotlight, but UNC7017’s approach adds a new wrinkle: by limiting tampering to windows of just five to ten minutes, the attacker dramatically reduces the forensic footprint while still achieving persistent access.
For defenders, the lesson is clear. Cryptographic code signing and verification for update mechanisms is not optional — it is the minimum bar. And any organization running software that phones home for updates should be monitoring that traffic for anomalies, even when the vendor’s servers appear clean. The servers may have been compromised and restored before anyone had time to notice.
Leave a Reply