Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.
The supply chain attacks took place between April and July 2026 and targeted the update and notification systems used by AOMEI Backupper, a Windows application for backing up data, cloning disks, and restoring systems.
Researchers at ManageEngine's Threat Analysis Lab (METAL), working with Google's Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks.
In reports published by Google and ManageEngine, the activity is attributed to a threat actor tracked as UNC7017, who used the compromised infrastructure to distribute a previously unknown malware downloader called CROSSROAD and a backdoor named SHINYROAD.
The researchers identified affected organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higher education.
However, Google warned that the attacks were opportunistic and could have affected additional organizations that checked for software updates during the brief periods when malicious files were being distributed.
Software
The attacks were first detected on May 28, when ManageEngine said its endpoint security software spotted AOMEI Backupper suddenly installing the legitimate remote administration tool Radmin on computers at two unrelated companies in different countries.
The Radmin installation was suspicious because AOMEI's built-in promotion processes launched it, which normally handle downloading and displaying promotional content and notifications.
However, when researchers attempted to reproduce the behavior on their own test systems, they found nothing malicious. Instead, the software contacted AOMEI's servers and downloaded the legitimate configuration file.
Further testing showed that instead of permanently replacing files on AOMEI's servers, the attackers briefly modified two configuration files used by the promotion and notification systems:
https://www2.aomeisoftware.com/download/abpopup/down_html.ini
https://account.aomeitech.com/Notifycfg.iniThe first file, down_html.ini, tells AOMEI Backupper where to download update packages. The second, Notifycfg.ini, controls notifications and can trigger content to run on the computer.
By modifying these files, the attackers redirected the software to download a malicious ZIP archive and then used the notification mechanism to execute the malware without requiring user interaction.
Researchers at Google later confirmed this execution flow in their own tests.
Source: Google
After failing to reproduce the original attack, ManageEngine began continuously monitoring AOMEI's servers.
On July 16, that monitoring finally captured the malicious modifications as they happened, confirming that AOMEI's systems were serving the malicious content.
The researchers also found that the attackers had modified the expected checksum in the update configuration, allowing the malicious archive to pass the software's file verification checks.
Google and ManageEngine say they identified three windows where the malicious configuration file was being sent by Aomei's servers:
-
May 28: 10-minute exposure window (05:40 – 05:50 UTC)
-
July 16: 6-minute exposure window (08:33 – 08:39 UTC)
-
July 20: 5-minute exposure window (10:35 – 10:40 UTC)
The attackers restored the configuration files back to its original form within minutes, making the compromise difficult to detect.
During these windows, the malicious configuration file was used to install the CROSSROAD and SHINYROAD malware.
When launched, the CROSSROAD downloader checked the performed reconnasaince on the infected computer, downloaded additional components, and established persistence through a scheduled task.
SHINYROAD is a backdoor that used legitimate Radmin components to load malicious code and establish an outbound connection to an attacker-controlled command-and-control server.
This allowed the attackers to potentially execute additional commands and payloads on compromised computers.
During the July 20 attack, Google also observed a second technique that attempted to steal Windows authentication hashes by forcing the software's notification system to access an attacker-controlled WebDAV resource through an invisible popup.
This technique could expose NTLM hashes that can be collected by the attacker-controlled server and later cracked using various tools.
The researchers also identified several IP addresses and hostnames used during the attacks, including 8.210.84[.]56, serv.oss-cn-hongkong[.]aliyuncs.com, hostnames under storage-data[.]com, and storage.googleapis.com, a legitimate Google Cloud Storage endpoint.
AOMEI says CTO is investigating
ManageEngine told BleepingComputer that it first notified AOMEI about the suspicious activity on June 7, more than a month before researchers directly captured the malicious configuration files being served from its servers.
At the time, AOMEI initially suggested that the content may have been intercepted and modified while in transit, an explanation the researchers disagreed with.
"The evidence did not support AOMEI’s explanation of interception in transit," reads ManageEngine's report.
"Both endpoints had retrieved the content over HTTPS from AOMEI-owned hostnames, across different countries and unrelated network paths, and the executable had arrived through the application’s own extraction sequence rather than being written directly to disk by an external process. The content had been altered before it reached either endpoint, within the vendor-hosted delivery path."
When ManageEngine captured another attack on July 16, it immediately provided AOMEI with the original and modified file hashes, file differences, and altered files.
"AOMEI engaged, conducted its own review, and told us its initial examination had not found evidence of a breach," ManageEngine told BleepingComputer.
The researchers said AOMEI indicated that it planned to move the affected configuration files to new infrastructure with more detailed logging.
ManageEngine told BleepingComputer it advised AOMEI to preserve existing evidence before making those changes and to bring in incident-response specialists, connecting the company with Mandiant to assist with the investigation.
AOMEI later informed the researchers that its technical team had upgraded its servers, patched potential vulnerabilities, and verified that the files hosted on its infrastructure were correct.
Google also confirmed in its report that Mandiant notified AOMEI about the configuration file tampering on July 17 and that the company responded on July 29th, stating it took corrective action.
When contacted by BleepingComputer about the findings, AOMEI said it was treating the matter as a high priority and that its chief technology officer was leading an internal investigation.
"We have also internally detected this report and have classified it as a high-priority matter. Our CTO is currently leading a dedicated investigation to ensure accurate issue identification," AOMEI told BleepingComputer.
The company said its CTO would provide a more detailed response about the incident and the investigation's progress, and BleepingComputer will update this article if we receive new information.
AOMEI did not immediately confirm how attackers gained access to its update infrastructure or whether the reported compromise had been fully resolved.
While AOMEI says it has secured its servers, ManageEngine warns that these changes would not remove malware previously installed on customers' computers.
"A server-side fix stops new infections; it does not remove the backdoor from machines that received it during an earlier window," ManageEngine told BleepingComputer.
Organizations using AOMEI Backupper are advised to review the indicators of compromise published by Google and ManageEngine, including suspicious scheduled tasks, unexpected executable files in AOMEI installation directories, and connections to attacker-controlled infrastructure.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.