It has been reported that hackers gained access to AOMEI’s servers to disseminate malware via a built-in promotional feature within its backup software. They briefly altered configuration files before reverting them to their original state to conceal the attacks.
The supply chain attacks occurred between April and July 2026, targeting the update and notification systems utilized by AOMEI Backupper, a Windows application designed for data backup, disk cloning, and system restoration.
Researchers from ManageEngine’s Threat Analysis Lab (METAL), in collaboration with Google’s Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and examined the attacks.
According to reports released by Google and ManageEngine, the activity has been linked to a threat actor identified as UNC7017, who exploited the compromised infrastructure to distribute a previously unknown malware downloader named CROSSROAD and a backdoor referred to as SHINYROAD.
The researchers identified impacted organizations across various countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, spanning sectors such as IT services, telecommunications, and higher education.
However, Google cautioned that the attacks were opportunistic and could have potentially impacted other organizations that sought software updates during the brief intervals when malicious files were being disseminated.
The attacks were initially detected on May 28, when ManageEngine reported that its endpoint security software observed AOMEI Backupper unexpectedly installing the legitimate remote administration tool Radmin on computers at two unrelated companies located in different countries.
The installation of Radmin raised suspicions because it was initiated by AOMEI’s built-in promotional processes, which typically manage the downloading and displaying of promotional content and notifications.
Nevertheless, when researchers tried to replicate the behavior on their test systems, they found no malicious activity. Instead, the software connected to AOMEI’s servers and retrieved the legitimate configuration file.
Further investigations revealed that rather than permanently altering files on AOMEI’s servers, the attackers temporarily modified two configuration files associated with the promotion and notification systems:
https://www2.aomeisoftware.com/download/abpopup/down_html.ini
https://account.aomeitech.com/Notifycfg.ini
The first file, down_html.ini, instructs AOMEI Backupper on where to download update packages. The second file, Notifycfg.ini, manages notifications and can trigger content execution on the computer.
By altering these files, the attackers redirected the software to download a malicious ZIP archive and subsequently utilized the notification mechanism to execute the malware without requiring any user interaction.
Researchers at Google later validated this execution flow in their own experiments.
After being unable to replicate the initial attack, ManageEngine began to monitor AOMEI’s servers continuously.
On July 16, this monitoring successfully captured the malicious modifications in real-time, confirming that AOMEI’s systems were delivering the harmful content.
The researchers also discovered that the attackers had altered the expected checksum in the update configuration, enabling the malicious archive to bypass the software’s file verification checks.
Google and ManageEngine reported identifying three specific timeframes during which the malicious configuration file was transmitted by AOMEI’s servers:
– May 28: 10-minute exposure window (05:40 – 05:50 UTC)
– July 16: 6-minute exposure window (08:33 – 08:39 UTC)
– July 20: 5-minute exposure window (10:35 – 10:40 UTC)
The attackers reverted the configuration files to their original state within minutes, making the compromise challenging to detect.
During these timeframes, the malicious configuration file was utilized to install the CROSSROAD and SHINYROAD malware.
Upon execution, the CROSSROAD downloader conducted reconnaissance on the infected computer, downloaded additional components, and established persistence through a scheduled task.
SHINYROAD serves as a backdoor that employed legitimate…
Source: Original article
