AOMEI Backupper servers hijacked for minutes at a time to push backdoor

An undisclosed cyberattack exploited the update mechanism of AOMEI Backupper version 8.3.0 and later, allowing attackers to covertly inject malicious packages into software updates for several brief periods between April and July 2026. The compromise involved manipulating configuration files on AOMEI's own servers during short windows—notably May 28, July 16, and July 20. When users checked in during these times, their software was redirected to download malicious payloads rather than legitimate content from the vendor.
Detection originated when ManageEngine’s endpoint monitoring registered AOMEI Backupper installing Radmin on customer machines in two different countries. Although AOMEI initially suspected transit tampering, security researchers concluded the alteration occurred within the vendor's delivery path itself. The attackers used specific configuration files to direct downloads and trigger a dropper named CROSSROAD, which installed a backdoor called SHINYROAD on susceptible systems before self-deleting.
While Google Threat Intelligence identifies the actors as UNC7017, no national affiliation has been assigned. Victims span numerous countries globally across IT services, telecom, and education sectors. The attack’s method of access to AOMEI's servers remains unknown, though corrective actions have reportedly been taken by the vendor.

Attackers repeatedly altered configuration files on AOMEI’s servers between April and July 2026.
Tampering occurred for periods lasting five to ten minutes at a time.
The activity affected AOMEI Backupper version 8.3.0 and later.
Confirmed tampering windows include May 28, July 16, and July 20.
ManageEngine's endpoint detection logged AOMEI Backupper installing Radmin on customer machines on May 28.
The malicious delivery utilized two files: downhtml.ini (controlling download) and Notifycfg.ini (triggering pop-ups).
The payload installed Radmin Server along with a backdoor named SHINYROAD if specific checks passed, which included blocking in China or if security products were present.
In the July 20 window, attackers leveraged the pop-up channel to force authentication against an attacker-controlled WebDAV server.
Google tracks the perpetrators as UNC7017.
Confirmed victims are organizations in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.

The narrative presents a severe systemic vulnerability: an attack vector residing within trusted software delivery infrastructure itself, rather than just at the endpoint or during transit. This challenges the foundational assumption of security—that external controls (like HTTPS) provide sufficient integrity guarantees for proprietary update mechanisms. The actors leveraged low-profile window manipulation and deceptive validation checks (checksums), indicating a sophisticated understanding of both the target application's internal logic and defensive monitoring blind spots.
The implications extend beyond compromised data; they touch upon foundational trust in software supply chains, illustrating how legitimate vendor channels can be weaponized for widespread dissemination of malware across disparate international sectors. The fact that credentials could leak even from machines where the dropper was blocked highlights a potential systemic risk rooted not just in execution, but in network interaction facilitated by the poisoned update logic.
This event requires an analysis of who benefits from such foundational attacks: actors capable of compromising core infrastructure gain leverage over numerous downstream users without needing to attack them individually. The central tension lies between the provider's assertion of integrity and the evidence of manipulation within their hosting environment.
A potential influence campaign leveraging this narrative might focus on creating generalized security panic among software users, pressuring them into adopting proprietary remediation tools or services that claim complete visibility into supply chain integrity. Does the breadth of discovery—hitting numerous unrelated organizations across different geographies from a single point of failure—suggest an opportunist actor maximizing exploitation, or does it hint at a pre-planned, targeted geographic deployment?
Patterns detected: none