Full Report
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a [...]
Analysis Summary
# Incident Report: AOMEI Backupper Update Infrastructure Supply Chain Compromise
## Executive Summary
Attackers reportedly compromised AOMEI's update and notification infrastructure between April and July 2026, briefly tampering with two configuration files so that AOMEI Backupper downloaded and executed malware on customer systems. The campaign, attributed to the threat actor UNC7017, delivered a previously unknown downloader (CROSSROAD) and a backdoor (SHINYROAD), and was opportunistic, so any organization that checked for updates during the exposure windows could have been affected. AOMEI says it has upgraded its servers and verified its files, but server-side fixes do not remove malware already installed on customer machines.
## Incident Details
- **Discovery Date:** May 28, 2026 (first detected by ManageEngine's endpoint security software; the server-side tampering was confirmed on July 16, 2026)
- **Incident Date:** April to July 2026 (three confirmed exposure windows: May 28, July 16, and July 20, 2026)
- **Affected Organization:** AOMEI (vendor, compromised infrastructure). Two unrelated companies in different countries were identified as initial victims. Their names were not disclosed in the available text.
- **Sector:** Software vendor (supply chain). Affected victim sectors include IT services, telecommunications, and higher education.
- **Geography:** Victims identified in the United States, Australia, India, Singapore, Spain, and Switzerland. AOMEI's infrastructure is tied to China-region hosting (Alibaba Cloud).
## Timeline of Events
### Initial Access
- **Date/Time:** Campaign window April 2026. Confirmed exposure windows:
- May 28, 2026, 05:40–05:50 UTC (10 minutes)
- July 16, 2026, 08:33–08:39 UTC (6 minutes)
- July 20, 2026, 10:35–10:40 UTC (5 minutes)
- **Vector:** Compromise of AOMEI's update and promotion/notification infrastructure. The article does not disclose how attackers obtained access to AOMEI's systems.
- **Details:** Attackers modified two files:
- `www2.aomeisoftware[.]com/download/abpopup/down_html.ini`, which controls where AOMEI Backupper downloads update packages. It was changed to point to a malicious ZIP archive.
- `account.aomeitech[.]com/Notifycfg.ini`, which controls notifications and can trigger content to run on the endpoint. It was used to execute the payload without user interaction.
The attackers also altered the expected checksum so the malicious archive passed the software's file verification.
### Lateral Movement
- The available article text does not describe lateral movement within victim networks. The malware's C2 channel and reconnaissance functions suggest follow-on activity was possible, but this is not confirmed in the excerpt.
### Data Exfiltration/Impact
- **Confirmed:** Installation of CROSSROAD and SHINYROAD on endpoints during exposure windows. Establishment of persistence via scheduled tasks. Outbound C2 connections enabling additional commands and payloads.
- **Credential exposure attempt:** During the July 20 window, a second technique forced the notification system to access an attacker-controlled WebDAV resource through an invisible popup. This could expose NTLM hashes for offline cracking.
- **Not disclosed:** Confirmed data theft volume or specific stolen data.
### Detection & Response
- **Detection:** ManageEngine's endpoint security software flagged AOMEI Backupper's promotion process installing the legitimate Radmin remote administration tool on two unrelated computers (May 28). Initial reproduction attempts on test systems found nothing malicious, so researchers continued monitoring AOMEI's servers. On July 16, monitoring captured the malicious modifications in real time.
- **Response actions:**
- ManageEngine advised AOMEI to preserve evidence before changes and engaged Mandiant for incident response.
- Mandiant notified AOMEI of the configuration tampering on July 17.
- AOMEI responded on July 29, stating it had taken corrective action, upgraded its servers, patched potential vulnerabilities, and verified its hosted files.
- Google GTIG and ManageEngine published IOCs and reports.
- AOMEI's CTO is leading an internal investigation. AOMEI has not confirmed how attackers gained access.
## Attack Methodology
- **Initial Access:** Compromise of AOMEI's update and notification infrastructure (method undisclosed). Malicious configuration changes served to clients.
- **Persistence:** Scheduled task created by the CROSSROAD downloader.
- **Privilege Escalation:** Not described in the available text.
- **Defense Evasion:** Malicious configuration changes were applied for only minutes and then restored to original form. The expected checksum was modified so the malicious archive would pass integrity checks. SHINYROAD used legitimate Radmin components to load malicious code.
- **Credential Access:** Forced NTLM authentication to an attacker-controlled WebDAV resource through a hidden notification popup, enabling hash capture and offline cracking.
- **Discovery:** CROSSROAD performed reconnaissance on infected hosts before downloading additional components.
- **Lateral Movement:** Not described in the available text.
- **Collection:** Not described in the available text.
- **Exfiltration:** Not confirmed. C2 communication was established via SHINYROAD. NTLM hash exposure was attempted.
- **Impact:** Arbitrary code execution, backdoor access, and potential credential compromise on victim endpoints.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Potential exposure of Windows NTLM hashes. Full scope unknown.
- **Operational:** Unauthorized remote access on affected endpoints. Scope of disruption not disclosed.
- **Reputational:** Significant damage to AOMEI's trust as a software vendor. The company has called the matter a high priority, and its CTO is leading the investigation. The article notes the company has not fully explained the intrusion.
## Indicators of Compromise
- **Network indicators (defanged):**
- `8.210.84[.]56` (attacker-controlled IP)
- `serv.oss-cn-hongkong[.]aliyuncs[.]com` (hostname)
- `www2.aomeisoftware[.]com/download/abpopup/down_html.ini` (tampered configuration file)
- `account.aomeitech[.]com/Notifycfg.ini` (tampered configuration file)
- Additional IOCs are referenced in the Google and ManageEngine reports, which were not included in the excerpt.
- **File indicators:**
- CROSSROAD downloader
- SHINYROAD backdoor
- Malicious ZIP archive delivered via `down_html.ini`
- Unexpected executables in AOMEI installation directories
- Radmin installations launched by AOMEI processes
- **Behavioral indicators:**
- Suspicious scheduled tasks
- AOMEI Backupper spawning Radmin installs or unexpected child processes
- Outbound connections to attacker-controlled infrastructure
- Outbound SMB/WebDAV authentication attempts from notification processes
## Response Actions
**Containment**
- AOMEI reportedly upgraded its servers and verified hosted files.
- Organizations were advised to review IOCs and identify affected systems.
**Eradication**
- Server-side fixes stop new infections but do not remove existing backdoors. ManageEngine notes that machines infected during earlier windows still need remediation.
- Affected endpoints should have scheduled tasks reviewed and removed, malicious executables deleted, and C2 connections blocked.
**Recovery**
- Rebuild or thoroughly remediate affected systems.
- Reset credentials, particularly for accounts whose NTLM hashes may have been exposed through the WebDAV technique.
## Lessons Learned
- **Key takeaways:**
- Trusted vendor update channels can be used to deliver malware. Update integrity checks that rely on checksums in the same configuration source can be bypassed.
- Short, transient tampering can evade detection. Attackers restored files within minutes.
- Behavioral monitoring of endpoint software (e.g., a backup tool launching a remote admin tool) was the key detection signal.
- Continuous external monitoring of vendor infrastructure was needed to capture the malicious changes.
- **What could have been done better:**
- Vendor notification and response were slow. Mandiant notified AOMEI on July 17 and AOMEI responded on July 29, a 12-day gap during which the July 20 exposure window occurred.
- Initial reproduction attempts failed, which delayed understanding of the attack.
- Vendor communication about how access was obtained remains incomplete.
## Recommendations
- **Verify update integrity independently:** Use code-signing and signature verification from separately trusted sources. Do not rely solely on checksums from the same update configuration.
- **Monitor software behavior:** Alert on backup, update, or promotional processes launching remote administration tools, scripts, or unsigned executables.
- **Restrict egress:** Limit outbound connections from endpoints to only approved destinations. Block outbound SMB/WebDAV authentication to external hosts.
- **Hunt for indicators:** Search for the listed IOCs, suspicious scheduled tasks, and unexpected Radmin installations, especially on systems running AOMEI Backupper.
- **Assume prior compromise for exposed systems:** Investigate endpoints that ran AOMEI Backupper during April–July 2026, and reset credentials for any accounts that may have had NTLM hashes exposed.
- **Application allowlisting:** Restrict which executables and ZIP-extracted payloads can run from software installation and update directories.
- **Vendor risk management:** Require vendors to disclose incidents promptly and to provide clear remediation timelines. Include supply chain attacks in third-party risk assessments.
- **Ongoing monitoring:** Continuously monitor the software supply chain, including update and notification endpoints, for unexpected changes.