AOMEI update servers hijacked in brief bursts to spread Windows malware

Hackers compromised AOMEI’s software distribution infrastructure to deliver Windows backdoors, switching malicious configurations on for just five to ten minutes before restoring legitimate content.

The campaign ran between April and July 2026 and affected software delivery channels used by AOMEI Backupper and AnyViewer, according to coordinated reports from Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine’s Threat Analysis Lab (METAL).

METAL first detected suspicious activity on May 28, when AOMEI Backupper installed remote administration software on two unrelated customers’ computers in different countries. Mandiant researcher Tyler McLellan detailed the wider campaign, tracked as UNC7017.

AOMEI develops Windows utilities for data backup, disk cloning, and disaster recovery through Backupper, alongside remote desktop and support software AnyViewer.

Identified victims included organizations in IT services, telecommunications, and higher education across 11 countries, including the United States, Australia, India, Brazil, and several European nations. GTIG says exposure was opportunistic: systems checking the affected servers during a tampering window could receive malware, so the actual reach may be broader.

Malicious content served for minutes

The attackers manipulated two configuration files used by AOMEI’s background update and promotional notification processes.

One, down_html.ini, told the application where to download a content archive and supplied its expected MD5 checksum. The other, Notifycfg.ini, controlled notification behavior that could trigger local execution.

Neither configuration was cryptographically authenticated by the client. By changing both the download location and the accompanying checksum, the attackers could make a malicious package pass the application’s integrity check.

METAL found an unsigned executable, upgrade-now.exe, embedded among 232 promotional files. A local HTML page automatically triggered the executable through the application’s embedded browser, requiring no user interaction beyond having the application running.

The chain abused existing application behavior rather than exploiting a software vulnerability.

Researchers confirmed tampering windows lasting ten minutes on May 28, six minutes on July 16, and five minutes on July 20. Authentic configurations returned afterward, meaning investigators checking the same URLs later saw clean content.

Mandiant described this as its first encounter with a software supply chain compromise using such brief delivery windows.

Backdoors and credential exposure

The malicious package delivered CROSSROAD, a downloader that retrieved additional components, created scheduled-task persistence, and deleted itself.

The subsequent SHINYROAD backdoor used a legitimate, digitally signed Radmin executable to load a malicious DLL. Its capabilities included remote shell commands and receiving additional code at runtime.

METAL confirmed that genuine Radmin Server software was installed but found no evidence it was running.

On July 20, the attackers also configured an invisible notification window to request a remote WebDAV resource. This could expose Windows NetNTLMv2 authentication material without executing malware, potentially enabling password cracking or authentication relay attacks.

Server fixes do not remove infections

METAL notified AOMEI on June 7, followed by Mandiant’s notification on July 17. AOMEI told Mandiant on July 29 that corrective action had been taken.

Restoring the servers does not remove malware already installed on users’ computers.

Organizations using either product should investigate activity throughout April–July, including unexpected executables under AOMEI’s html directories and scheduled tasks named RadminComponentRuntime or NitroRuntime. Users who suspect exposure should seek endpoint investigation.