Google Finds Hackers Hijacked AOMEI Updates to Distribute Backdoors

Google Threat Intelligence Group researchers disclosed a supply chain campaign where the threat actor group UNC7017 hijacked AOMEI Technology’s update servers to distribute malware. The attackers briefly modified server configurations between April and July 2026, injecting malicious content before restoring legitimate files to evade detection.

ManageEngine’s Threat Analysis Lab first spotted the activity on May 28 through endpoint telemetry. This early detection allowed investigators to reconstruct the infection chain, even though later inspections of the vendor’s servers showed only clean, legitimate software. The attackers restored original content before conventional security scans could reliably capture the compromise.

Technical Mechanics of the Attack

The UNC7017 group did not permanently alter released software binaries. Instead, they weaponized two specific configuration files: down_html.ini and Notifycfg.ini. These files controlled download locations and notification components within the AOMEI Backupper and AnyViewer applications.

Attackers changed the download destination to point to a malicious archive. They also incremented version values and supplied a matching MD5 checksum for their trojanized package. Because the client software did not independently authenticate these configuration files, the altered integrity values allowed the malicious download to pass the application’s internal checks.

No memory corruption exploit or Common Vulnerabilities and Exposures ID was required for this attack. The malicious upgrade-now.zip file delivered upgrade-now.exe, which Google researchers identified as the CROSSROAD downloader. This loader subsequently deployed the SHINYROAD backdoor through the trusted software update workflows.

Scope and Affected Organizations

The campaign targeted IT services, telecommunications providers, and higher education organizations across eleven countries. Confirmed victims were located in India, Australia, Brazil, and the United States, among other nations. Exposure was opportunistic, meaning any system polling the compromised infrastructure during an active tampering window could have received the malware.

Researchers noted that the identified victims likely represent only a fraction of the campaign’s total reach. Confirmed exposure windows were extremely brief, lasting ten minutes on May 28, six minutes on July 16, and five minutes on July 20. This short duration highlights the difficulty of capturing the compromise through traditional server-side monitoring alone.

What should you do?

Security teams should review endpoint telemetry for unexpected connections to AOMEI update servers during the specified dates. Organizations using AOMEI Backupper or AnyViewer should verify the integrity of their current installations against known good hashes. Continuous monitoring remains essential, as attackers may resume similar supply chain tactics.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: AOMEI Technology

• Review endpoint logs for connections to AOMEI update infrastructure between April and July 2026.
• Verify current software versions against official vendor hashes to detect any prior tampering.
• Monitor for the presence of CROSSROAD or SHINYROAD indicators of compromise within your environment.
• Implement strict integrity monitoring for configuration files that control software download locations.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did this attack require a known vulnerability or CVE?

No, the attackers bypassed security by modifying configuration files and providing matching checksums, without using memory corruption exploits.

Which software products were involved in this supply chain attack?

The campaign targeted updates for AOMEI Backupper and AnyViewer, delivered through AOMEI Technology’s update infrastructure.

How long were the servers compromised at each instance?

Confirmed exposure windows lasted ten minutes on May 28, six minutes on July 16, and five minutes on July 20.