AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

Security researchers from Google Cloud’s Google Threat Intelligence Group and Mandiant reported that the AOMEI Backupper software was compromised in a series of short-burst supply chain attacks between April and July 2026. The threat actor, tracked as UNC7017, injected malware into the application’s distribution channels, serving malicious payloads to unsuspecting users during brief tampering windows.

The attackers modified the update server’s settings files to redirect downloads to a malicious ZIP archive containing the CrossRoad downloader. They also altered the server’s automatic notification service to force systems to execute the malware immediately upon fetching the package. This method allowed the distribution of the ShinyRoad modular backdoor framework to any system that updated during the active compromise windows.

Attack Methodology and Timeline

According to the joint investigation by Google Cloud, Mandiant, and ManageEngine Threat Analysis Lab (METAL), each tampering window remained active for only five to ten minutes before the servers reverted to authentic versions. This rapid reversion suggests an opportunistic campaign designed to evade detection rather than a persistent, targeted intrusion. Google Cloud noted that while they confirmed several windows in 2026, additional tampering likely occurred outside their visibility due to the short duration.

METAL’s analysis revealed that hackers abused AOMEI Backupper’s promotional content channel for distribution. This channel runs background services that poll AOMEI’s servers for content. Two configuration paths deliver content to a directory and execute it, converging on the same location. One path controls what lands in the html folder, while the other controls execution from that directory, facilitating the malware drop.

Affected Organizations and Regions

The campaign impacted users across multiple sectors and geographies. Google Cloud identified compromises in higher education, IT services, and telecommunications entities. Affected countries included Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. AOMEI Backupper is Windows backup, sync, and disk cloning software available in free and paid editions. The company states its products are used by more than 186 million people worldwide, including home users, businesses, and Windows Server environments.

This incident follows a pattern of supply chain disruptions in the software industry. As Threat Times reported on 2026-10-19, the Rank Math PRO plugin was similarly compromised in a supply chain attack that distributed malware through version 3.0.123 packages. Unlike the Rank Math incident, which involved self-restoring backdoors, the AOMEI campaign relied on transient server-side tampering to serve the ShinyRoad backdoor.

What should you do?

Organizations should verify the integrity of their AOMEI Backupper installations and review logs for unexpected execution events during the April to July 2026 period. Security teams should monitor for indicators of compromise associated with the CrossRoad downloader and ShinyRoad framework. Administrators should assess whether their systems communicated with AOMEI update servers during the short tampering windows identified by researchers.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: AOMEI Backupper

• Review system logs for unauthorized execution events or connections to AOMEI servers during the April to July 2026 timeframe.
• Scan endpoints for indicators of compromise related to the CrossRoad downloader and ShinyRoad backdoor framework.
• Verify the integrity of installed software packages against known good hashes to detect any residual tampering.
• Monitor network traffic for unusual outbound connections that may indicate active backdoor communication.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which threat actor was responsible for the AOMEI Backupper compromise?

The threat actor tracked as UNC7017 was identified by Google Cloud and Mandiant as responsible for the supply chain attack.

How long did the malicious update windows remain active?

Each tampering window remained active for only five to ten minutes before reverting to authentic versions of the software.

What malware was distributed through the compromised AOMEI Backupper updates?

The attacks distributed the CrossRoad downloader and the ShinyRoad modular backdoor framework to affected systems.