Attackers tampered with the update infrastructure of AOMEI Technology to push malware to users of its AOMEI Backupper and AnyViewer software, according to joint research from Google Threat Intelligence Group (GTIG) and Mandiant, published October 15, and from ManageEngine's Threat Analysis Lab (METAL), published October 16. GTIG places the campaign activity between April and July 2026. BleepingComputer reported the findings on October 19.

GTIG attributes the activity to a threat cluster it tracks as UNC7017. According to METAL, the endpoint delivery "exploited no software defect" and there is no CVE; how the attackers got into AOMEI's servers has not been disclosed. According to METAL, "Tampering lasted only a few minutes at a time on isolated dates." GTIG says: "This is the first time that we have encountered a software supply chain compromise that was implemented with these very short windows, effectively evading traditional point-in-time triage and automated file scanning."

GTIG says the impacted organizations spanned "IT services, telecommunications, higher education and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States." It adds that the victimology "was opportunistic and likely extends more broadly."

How the tampering worked

GTIG says AOMEI's ABMarket update flow and its background services, Backupper.exe and ABNotify.exe, poll remote endpoints over HTTPS. Two remote configuration files are involved. METAL says down_html.ini declares the package URL and the expected MD5 hash, and Notifycfg.ini controls what the notification popup runs. It also says the client does not cryptographically authenticate either file. During each window the actor altered these files so that clients fetched a malicious package. The files were then returned to their authentic versions. METAL observed the activity on AOMEI Backupper v8.3.0 and later.

Because the files were reverted within minutes, GTIG says "the vendor's server returns authentic, clean files most of the time, leading analysts to mistakenly dismiss the detection as a false positive." Its guidance is direct: "Defenders must not rely on live web checks."

The researchers documented four malware components:

  • CROSSROAD, a downloader delivered as upgrade-now.exe. METAL says the file is unsigned, carries AOMEI publisher metadata and the product string "AOMEI Update Compent," and terminates if the host IP geolocates to China or if geolocation fails. It also halts if certain endpoint security agents are present. After staging its payload, it deletes itself.
  • SHINYROAD, a modular backdoor delivered inside a trojanized Famatech Radmin 3.x bundle. METAL identifies the implant as RuntimeComponent.dll, which runs as "an in-process COM server hosted inside a signed Windows dllhost.exe surrogate." It decrypts its configuration with ChaCha20 to produce a pocketpy payload.
  • ADAPTAGENT, an Adaptix C2 client that GTIG says was deployed in mid-July 2026, disguised as Nitro PDF tools.
  • A modified Radmin Server, which GTIG says the May 28 wave installed silently "to establish persistent remote access."

Tactics changed between the documented windows. On July 16, GTIG says, the actor injected "over 35,000 lines of repetitive configuration sections" into Notifycfg.ini to force an update regardless of the installed version. On July 20, the actor replaced a legitimate promotional banner with an invisible popup. GTIG says this could coerce endpoints into transmitting NetNTLMv2 hashes "without user visibility." The same wave also moved the initial download to a public Google Cloud Storage bucket, which GTIG says was done to get past proxy filters that block newly registered domains.

Timeline

Events are dated to when they happened, according to the sources. Times are UTC. GTIG says "it is probable that additional tampering occurred throughout the campaign that remained outside our visibility."

  • April 2026: Campaign activity begins, according to GTIG.
  • May 28, 05:40–05:50: First documented tampering window. METAL says its EDR recorded AOMEI installing Radmin on one endpoint, and the same chain appeared in the same window on a second, unrelated endpoint in another country.
  • June 7: METAL notified AOMEI.
  • July 16, 08:33–08:39: Second documented window, with the configuration-file padding. METAL's monitor captured the tampered content.
  • July 17: Mandiant notified AOMEI and provided indicators.
  • July 20, 10:35–10:40: Third documented window, with the credential-coercion popup. This was 43 days after METAL's notification and three days after Mandiant's.
  • July 29: According to GTIG, AOMEI responded that corrective actions had been taken.

AOMEI's response

According to METAL, AOMEI's initial explanation was that "the content had been intercepted and modified in transit." METAL disagrees: "The content had been altered before it reached either endpoint, within the vendor-hosted delivery path."

BleepingComputer reports that AOMEI later told the researchers its technical team had upgraded its servers, patched potential vulnerabilities and verified the files hosted on its infrastructure. BleepingComputer does not date that statement. AOMEI also told BleepingComputer it had classified the report as "a high-priority matter" and that "Our CTO is currently leading a dedicated investigation to ensure accurate issue identification." According to BleepingComputer, AOMEI "did not immediately confirm how attackers gained access to its update infrastructure or whether the reported compromise had been fully resolved."

METAL says: "As of publication, we have not independently verified that the compromise has been contained." Both research teams say vendor-side fixes do not clean endpoints. METAL writes that "Server-side remediation does not clean an endpoint that already received a payload during an earlier tampering window." GTIG writes that "Organizations running AOMEI software cannot assume they are protected solely because the vendor took corrective server-side action."

What It Means for Defenders

  • Hunt retrospectively from April to July. GTIG says enterprise teams must hunt across endpoints and the network over that whole period, using its indicators and YARA rules. Check for the scheduled tasks \RadminComponentRuntime and \NitroRuntime, and review %LOCALAPPDATA%\Radmin\ and %LOCALAPPDATA%\Nitro Pro\.
  • Collect evidence from endpoints and logs. Preserve the AOMEI configs cached under %PROGRAMFILES(X86)%\AOMEI\*\Tmphtml\ and review proxy and firewall telemetry for the windows in the timeline.
  • Deploy METAL's two Sigma rules. They flag Backupper.exe staging executables in the Tmphtml directory and ABNotify.exe launching executables from its rendering directory.
  • Block outbound SMB (TCP 445) and WebDAV to external IP addresses, as GTIG recommends, to stop NTLM credential coercion. Also block the indicators GTIG lists: storage-data[.]com and its subdomains, 8.210.84[.]56, 47.239.60[.]117 and 8.218.65[.]184.

Sources