Between April and July, security specialists uncovered that AOMEI Backupper was compromised in several short-lived supply chain incidents, distributing malware to its users. This software, widely used for Windows backup and disk cloning, is available to both individual and business users across the globe.
Malware Distribution Through Short-Burst Attacks
Unlike typical prolonged supply chain breaches, this particular campaign was characterized by brief tampering periods. During these intervals, malicious software such as the CrossRoad downloader and ShinyRoad backdoor was disseminated. Google Cloud’s Threat Intelligence Group (GTIG) and Mandiant, in collaboration with ManageEngine Threat Analysis Lab (METAL), reported that these tampering windows lasted only five to ten minutes before reverting to legitimate software versions.
Global Impact and Targeted Industries
The attack was indiscriminate, affecting any system downloading the compromised AOMEI Backupper packages during the active windows. Despite the broad reach, certain sectors including higher education, IT services, and telecommunications in numerous countries like Australia, Brazil, and the United States were notably impacted.
Google Cloud highlighted that several tampering incidents were confirmed throughout 2026, with malware samples detected from late April onward. The brief duration of these windows suggests additional undetected tampering episodes might have occurred.
A Deeper Look Into the Attack Methods
The attackers, identified as UNC7017, manipulated the update server’s settings to redirect users to a harmful ZIP archive, simultaneously altering the automatic notification service to prompt malware execution. METAL’s analysis revealed that the promotional content channel of AOMEI Backupper was exploited for malware distribution, utilizing background services that retrieve content from AOMEI’s servers.
ManageEngine’s team observed changes in payloads in May, with further modifications noted in July. The payload analysis showed legitimate software like Radmin Server was used to deploy a malicious DLL, establishing a reverse connection to a command-and-control server.
Broader Implications and Response
This campaign signifies a shift in supply chain attack strategies, focusing on temporary configuration tampering rather than altering software source code. Despite initial dismissals from AOMEI Technology regarding potential tampering, corrective actions were eventually reported by the end of July following further notifications from Google Cloud.
The events underscore the evolving nature of software supply chain threats and the importance of robust security measures to safeguard against such innovative attack methodologies.
