AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

The campaign involved multiple short-burst supply chain compromises of AOMEI Backupper's update infrastructure between April and July 2026. The attacker UNC7017 manipulated update server configuration files to serve malicious ZIP archives and forced automatic execution of malware. Delivered payloads included the CrossRoad downloader, a modified Radmin Server with a malicious DLL establishing reverse TCP connections, and the ShinyRoad modular backdoor framework. The attacker also used a WebDAV-based technique to capture NetNTLMv2 hashes. The tampering windows were brief (5-10 minutes) and reverted to legitimate versions, indicating a stealthy, opportunistic campaign rather than a targeted attack. The campaign represents an evolution in supply chain attacks by using ephemeral configuration tampering instead of source code or build pipeline compromises. Vendor notification was initially dismissed but later led to corrective measures.

Users who downloaded AOMEI Backupper updates during the short compromise windows were served malware that established persistent backdoors and remote access capabilities. The delivered payloads allowed attackers to execute arbitrary code, establish reverse TCP connections to command-and-control servers, and potentially harvest authentication hashes. The attack affected a wide user base, including higher education, IT services, and telecommunications sectors across multiple countries. The stealthy nature of the short-lived tampering windows increased the difficulty of detection and response.

AOMEI Technology has taken corrective actions following vendor notifications in mid to late 2026. Users should ensure they are running versions of AOMEI Backupper obtained after these corrective actions. Due to the nature of the attack involving update server tampering, users should verify the integrity of update sources and consider additional endpoint detection for signs of the ShinyRoad backdoor or related malware. Patch status is not explicitly confirmed; users should consult AOMEI's official communications for current remediation guidance.