AOMEI Updates: Minutes Were Enough for a Backdoor

From April to July 2026, the UNC7017 group tampered with AOMEI software update configurations for just five to ten minutes at a time. This route carried the CROSSROAD downloader and the SHINYROAD backdoor to organizations in eleven countries. A server-side fix does not remove the malware from end devices.

Related: KnowBe4: One link starts three phishing routes  ·  When the pentest agent switches sides

A Window of a Few Minutes

A software update configuration is an unremarkable file. It tells the installed program what to fetch and from where. At AOMEI, the maker of the AOMEI Backupper backup software, precisely this file became the entry point between April and July 2026.

The group tracked as UNC7017 altered the configuration repeatedly for short periods, as Mandiant and the Google Threat Intelligence Group document. Afterwards, the original version was back in place. Machines that read the configuration during these windows received the tampered version. Available telemetry, meaning the operational data collected by security products, was used to identify affected organizations in eleven countries.

What is a supply chain attack? In a supply chain attack, attackers compromise a vendor, a service provider or their distribution channels. The malware then reaches the actual targets through a channel those targets trust. In the AOMEI case, that channel was the software’s update configuration.

A Promotional Channel Without Authenticity Checks

The attack required no vulnerability. UNC7017 abused the promotional channel that AOMEI built into its software. Users did not need to click or confirm anything extra.

The client never cryptographically authenticated the configuration files. It therefore could not tell whether a file genuinely came from the vendor. The configuration did contain a checksum for the archive to be downloaded. That checksum, however, sat in the same unprotected file as the download address. Whoever could swap the address could also insert the matching checksum.

The dropper, a program that places further malware onto the system, carried no privilege escalation mechanism of its own. It inherited the permissions of the AOMEI process that launched it.

Backdoor With an Outbound Connection

Two tools reached the machines through the attack chain. CROSSROAD is a downloader that fetches additional components. SHINYROAD is a modular backdoor framework whose functions are built from individual modules.

In the cases investigated by the ManageEngine Threat Analysis Lab (METAL), remote access ran over a separate outbound connection. The implant, meaning the malware placed on the machine, established this connection. Contact with the attackers therefore originated from the infected system itself.

Fixes Without Independent Verification

Mandiant notified AOMEI on 17 July 2026. On 29 July 2026, the vendor reported completed remediation measures to Mandiant. When the METAL investigation was published a few days ago, independent verification of whether those measures contain the compromise was still pending.

For organizations running AOMEI software, a fix at the vendor changes little about their own environment anyway. Server-side fixes do not eliminate malware that is already installed on end devices.

Retrospective Searches Back to April

Organizations running AOMEI software should retrospectively examine their end devices and network data for the period April to July 2026. These investigations should be based on the indicators and YARA rules published by Mandiant. Indicators are technical traces of an attack, such as file characteristics or network addresses. YARA rules describe patterns that reveal malicious files.

The METAL researchers additionally recommend preserving cached files from the application. Those responsible should cross-check alert times from security systems against network logs. The campaign’s victim selection was opportunistic. The campaign probably affected more organizations than have been identified so far.

Frequently Asked Questions

The answers are hidden. Tap a question to reveal its answer.

Are organizations in the German-speaking region affected?

Switzerland is among the eleven countries where affected organizations were identified. The list relies on available telemetry for the period April to July 2026.

Does AOMEI Backupper 8.5.0 fix the security flaw in the update channel?

With version 8.5.0, AOMEI Backupper received fixes for backup, cloning and restoration on 9 October 2026. A correction to the update authentication is not listed in the associated changelog entry.

What role does the installed Radmin Server play?

A Radmin Server, a remote access tool, was installed on the examined systems. The METAL investigation showed no confirmed activity from it. Remote access there ran over the implant’s connection.

Editor’s Picks

Editor’s PickWhen Paid AI Routers Inject Malicious Code

More from the MBF Media Network

cloudmagazinGoogle counters Meta with top AI at half the priceDigital ChiefsMicrosoft: Germany Is EU’s Top Cyberattack Target

Image source: AI-generated (October 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.