AOMEI Backupper Supply Chain Attack Distributed CROSSROAD and SHINYROAD Malware
Hackers reportedly compromised AOMEI’s servers and used promotional features built into the AOMEI Backupper backup software to distribute malware. The attackers briefly altered configuration files and restored them to their original state within minutes to conceal the activity.
The supply chain attack occurred between April and July 2026 and targeted the update and notification system used by AOMEI Backupper, a Windows application for data backup, disk cloning, and system restoration.
Researchers at ManageEngine’s Threat Analysis Lab (METAL) worked with Google’s Threat Intelligence Group (GTIG) and Mandiant to uncover and investigate the campaign.
According to reports from Google and ManageEngine, the activity was attributed to a threat actor tracked as UNC7017. The attackers used compromised infrastructure to distribute an unknown malware downloader named CROSSROAD and a backdoor named SHINYROAD.
Researchers identified affected organizations in the IT services, telecommunications, and higher education sectors across the United States, Australia, India, Singapore, Spain, and Switzerland.
Google warned that the attack was opportunistic and may have affected other organizations that checked for software updates during the brief periods when malicious files were distributed.
How the AOMEI Backupper supply chain attack worked
The attack was first detected on May 28, when ManageEngine found that AOMEI Backupper had suddenly installed the legitimate Radmin remote administration tool on computers belonging to two unrelated companies in different countries.
The Radmin installation was suspicious because it was launched by AOMEI Backupper’s built-in promotion process. This feature normally downloads and displays promotional content and notifications.
When researchers attempted to reproduce the behavior on their own test systems, they did not observe anything malicious. Instead, the software connected to AOMEI’s servers and downloaded legitimate configuration files.
Further testing showed that the attackers had not permanently replaced files on AOMEI’s servers. Instead, they modified two configuration files used by the software’s promotion and notification system.
The down_html.ini file tells AOMEI Backupper where to download update packages. The Notifycfg.ini file controls notifications and can trigger content to run on the computer.
By modifying these files, the attackers redirected AOMEI Backupper to download a malicious ZIP archive. They also abused the notification mechanism to execute the malware without requiring user interaction.
Google researchers later confirmed this execution flow in their own testing.
Source: Google
After failing to reproduce the original attack, ManageEngine began continuously monitoring AOMEI’s servers. On July 16, that monitoring captured a malicious change as it occurred, confirming that AOMEI’s systems were serving malicious content.
Researchers also found that the attackers modified the expected checksums in the update configuration. This allowed the malicious archive to pass the software’s file validation checks.
Three brief windows of malicious activity
Google and ManageEngine identified three periods during which malicious configuration files were sent from AOMEI’s servers:
- May 28: 10-minute exposure window, from 05:40 to 05:50 UTC
- July 16: 6-minute exposure window, from 08:33 to 08:39 UTC
- July 20: 5-minute exposure window, from 10:35 to 10:40 UTC
The attackers restored the configuration files to their original format within minutes, making the compromise difficult to detect. During these exposure windows, the malicious configurations were used to install the CROSSROAD downloader and SHINYROAD backdoor.
CROSSROAD and SHINYROAD malware capabilities
Once launched, the CROSSROAD downloader verified reconnaissance performed on the infected computer, downloaded additional components, and established persistence through scheduled tasks.
SHINYROAD is a backdoor that uses a legitimate Radmin component to load malicious code and establish an outbound connection to an attacker-controlled command-and-control server. This could allow the attacker to execute additional commands or payloads on the compromised computer.
During the July 20 attack, Google observed another technique involving the software’s notification system. An invisible popup forced the application to access attacker-controlled WebDAV resources in an attempt to steal Windows authentication hashes.
The technique could expose NTLM hashes to attacker-controlled servers. The collected hashes can later be decrypted using various tools.
Infrastructure linked to the AOMEI Backupper attack
Researchers identified the following IP addresses and hostnames associated with the campaign:
8.210.84[.]56serv.oss-cn-hongkong[.]aliyuncs.comstorage-data[.]comstorage.googleapis.com, a legitimate Google Cloud Storage endpoint
AOMEI says its CTO is investigating
ManageEngine told BleepingComputer that it first notified AOMEI about the suspicious activity on June 7, more than a month before researchers directly captured malicious configuration files being served from AOMEI’s servers.
At the time, AOMEI initially suggested that the content may have been intercepted and altered in transit. Researchers disagreed with that explanation.
“Evidence did not support AOMEI’s explanation for in-transit interception,” ManageEngine’s report said.
“Both endpoints were retrieving content over HTTPS from AOMEI-owned hostnames across different countries and unrelated network paths. Also, the executables were arriving through the application’s own extraction sequences, rather than being written directly to disk by an external process. The content had been modified within the vendor-hosted delivery path before reaching either endpoint.”
ManageEngine detected another attack on July 16 and immediately provided AOMEI with the original and modified file hashes, file differences, and modified files.
“AOMEI became involved, conducted its own investigation, and informed us that initial investigation found no evidence of compromise,” ManageEngine told BleepingComputer.
According to the researchers, AOMEI indicated plans to move the affected configuration files to new infrastructure with more detailed logging.
ManageEngine told BleepingComputer that it advised AOMEI to preserve existing evidence and connected the company with Mandiant to provide incident response expertise before making those changes.
AOMEI later informed researchers that its technical team had upgraded its servers, patched potential vulnerabilities, and verified that the files hosted on its infrastructure were correct.
Google also said in its report that Mandiant notified AOMEI about the tampered configuration files on July 17. AOMEI responded on July 29 that it had taken corrective action.
Contacted by BleepingComputer about the findings, AOMEI said it was treating the issue as a top priority and that its chief technology officer was leading an internal investigation.
“We also detected this report internally and classified it as a high-priority issue. Our CTO is currently leading a dedicated investigation to ensure accurate issue identification,” AOMEI told BleepingComputer.
The company said its CTO would provide more detailed answers about the incident and the investigation’s progress. BleepingComputer said it would update the article as new information becomes available.
AOMEI did not immediately confirm how the attackers gained access to the update infrastructure or whether the reported breach had been fully resolved.
What AOMEI Backupper users should do
Although AOMEI says its servers are secure, ManageEngine warned that server-side changes will not remove malware previously installed on customers’ computers.
“While the server-side fixes stop new infections, they do not remove the backdoor from machines that received it in previous periods,” ManageEngine told BleepingComputer.
Organizations using AOMEI Backupper are advised to check for indicators of compromise published by Google and ManageEngine, including suspicious scheduled tasks, unexpected executable files in the AOMEI installation directory, and connections to attacker-controlled infrastructure.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com