In a strategic cyber-attack, perpetrators altered the update servers of AOMEI Backupper, a Windows backup software, to distribute a backdoor. This breach, occurring in brief intervals from May to July 2026, affected systems worldwide, allowing attackers to install malicious software during update checks.
Compromise of Update Mechanisms
Security experts from Google Threat Intelligence, Mandiant, and ManageEngine’s Threat Analysis Lab uncovered this operation, revealing that despite server repairs by AOMEI, infected systems remain vulnerable. The Hong Kong-based AOMEI Technology, behind both Backupper and AnyViewer, has software that regularly checks for updates via HTTPS. However, two critical files, down_html.ini and Notifycfg.ini, lacked cryptographic validation, enabling attackers to alter them and facilitate the backdoor installation.
The attack did not exploit software vulnerabilities or user actions but relied on brief server-side file modifications. Systems checking for updates during these windows downloaded compromised files, which executed with the same privileges as AOMEI’s processes.
Global Impact and Targeted Campaign
Three specific windows of server tampering were confirmed, with additional instances suspected. Affected times included May 28, July 16, and July 20, 2026. The limited duration and opportunistic nature of these windows complicated detection efforts, impacting diverse sectors across 11 countries, including the United States, India, and Australia.
GTIG’s research identified UNC7017 as the group behind this supply chain attack. The breach’s sophistication, leveraging Windows systems in a short timeframe, evaded traditional security measures, posing challenges for IT services, telecommunications, and educational institutions.
Methods and Mitigation Strategies
Once infiltrated, the malware known as CROSSROAD deposited a payload in the system’s Radmin folder, establishing a scheduled task for persistent execution. A legitimate Radmin tool was included but remained inactive, while a separate implant facilitated remote control.
The attack used WebDAV to capture authentication tokens invisibly, further complicating defenses. GTIG advises organizations to examine their systems retrospectively from April to July 2026, and maintain vigilance despite server rectifications.
Organizations are urged to scrutinize cached files and network logs during the alert times, while also blocking associated domains and IP addresses. GTIG and ManageEngine have released detection rules to aid in identifying compromised systems.
As the cybersecurity community continues to analyze and respond to this breach, the need for robust update verification mechanisms and proactive monitoring remains paramount in safeguarding against such sophisticated threats.
