AOMEI Update Tampering Turns Minutes Into A Supply-Chain Blind Spot

Google Threat Intelligence Group and Mandiant disclosed a supply-chain campaign that tampered with AOMEI Technology update infrastructure between April and July 2026. The actor, tracked as UNC7017, changed update and notification configuration on AOMEI origin servers for only five to ten minutes at a time. Systems that checked during those windows received malicious instructions; checks immediately before or after returned authentic content. Google says the campaign delivered the CROSSROAD downloader and SHINYROAD backdoor, while ManageEngine's METAL team traced the first confirmed endpoint chain through AOMEI Backupper's normal in-application content path.

A current clean server, current vendor download, or upgraded client cannot prove that an endpoint missed an earlier window. CROSSROAD restored local configuration, deleted artifacts, established scheduled-task persistence, and staged follow-on components. A July wave also used a one-pixel WebDAV resource to coerce NetNTLMv2 authentication. AOMEI told Mandiant on July 29 that corrective actions had been taken, but Google explicitly warns that server-side remediation does not disinfect endpoints. Organizations need deployment inventory, historical EDR and proxy review, published indicator hunting, credential scoping, and trusted endpoint recovery.

Google and Mandiant place the campaign between April and July 2026 and say directly observed server modifications lasted only five to ten minutes. Confirmed windows included ten minutes on May 28, six minutes on July 16, and five minutes on July 20. Malware samples and related telemetry extend the visible activity back to late April, and the researchers assess that additional windows probably escaped observation.

The delivery result depended on timing. A client that requested the configuration while tampering was active received a malicious package location and execution instructions. The same request before or after the window returned legitimate AOMEI content. ManageEngine reproduced the normal flow in a lab after investigating two affected customer endpoints and found nothing malicious, then continued because its endpoint telemetry showed the original process chain.

This pattern breaks a common triage shortcut. Fetching the URL now, checking its current certificate, or rescanning the present configuration only describes current state. It does not reconstruct what an endpoint received months earlier. Historical endpoint, DNS, proxy, firewall, and content-capture data become primary evidence.

AOMEI Backupper and AnyViewer use an ABMarket flow in which background processes request two configuration files over HTTPS. down_html.ini supplies the available version, package URL, and expected MD5 value. Notifycfg.ini controls in-application notices and can specify local commands or programs. Under normal conditions, these files point to AOMEI-hosted content.

UNC7017 changed both sides of that control path. During the July 16 window, it replaced the package URL, incremented the minor build value, and supplied the MD5 for the malicious archive. It also expanded the notification configuration with more than 35,000 repetitive sections, overriding normal version checks so the client would trigger the download and execute the unpacked CROSSROAD loader.

The MD5 check did not provide independent authenticity because the same unauthenticated configuration named both the file and its expected digest. The attacker did not need to find a collision. It replaced the package reference and the comparison value together. Transport encryption protected the client-to-server connection, but the trusted server-side configuration itself had been altered.

ManageEngine's endpoint record showed ABNotify.exe processing a 232-file promotional bundle. The included upgrade-now.html created a link to a sibling upgrade-now.exe and clicked it programmatically. Because Notifycfg.ini loaded the page from a local file path inside AOMEI's rendering directory, the embedded WebView handed the executable to the system shell. The chain used intended content-handling behavior rather than a separate browser or WebView vulnerability.

No additional user interaction was required while the application was running. That makes the process ancestry more useful than the apparent package name. An unsigned executable launched by ABNotify.exe from an AOMEI html directory is not a normal software update merely because the parent path is trusted. ManageEngine published a Sigma rule for this parent-child pattern and reports no known legitimate executable launches from the rendering hierarchy.

The actor also varied infrastructure. Early payloads used Alibaba Cloud Object Storage, July activity moved to vendor-themed storage-data.com hosts, and the July 20 initial package came from a public Google Cloud Storage bucket before later stages used attacker domains. Blocking only newly registered domains would miss the cloud-hosted first step.

CROSSROAD was the initial downloader and environment gate. It checked its path for the AOMEI name, queried public services to identify the system's external address and country, avoided its main payload path for systems geolocated to China, and used a global mutex to prevent duplicate execution. It also looked for selected security products and could halt in environments likely to expose the chain.

The loader then worked against forensic reconstruction. Google says it restored the local update URL and build value to the legitimate defaults, removed temporary files, and could self-delete. It created the RadminComponentRuntime scheduled task to launch a follow-on process every three hours. An administrator inspecting the current configuration could therefore see the correct vendor URL while persistence and payload components remained elsewhere on the host.

The follow-on tooling mixed legitimate and malicious components. ManageEngine observed the genuine Radmin Server installer, but did not find evidence that Radmin itself was running. Remote access instead depended on an attacker DLL side-loaded by a legitimate launcher, which registered an encrypted PocketPy implant inside dllhost.exe. Google also links campaign infrastructure to Adaptix command-and-control components and tracks the modular backdoor as SHINYROAD.

On July 20, the modified notification file replaced a legitimate promotional banner with a one-by-one-pixel window that requested a file URL through WebDAV from 8.210.84.56. The hidden request could cause Windows to transmit a NetNTLMv2 challenge-response value to the attacker-controlled system without visible user interaction.

That is separate from the malware package path and expands the response beyond file hashes. Teams should review outbound SMB and WebDAV exposure, authentication telemetry, and use of the affected endpoint's account during and after the window. A captured NetNTLMv2 value is not a plaintext password, but it can support offline cracking or relay in environments where protocol and signing controls allow it.

Google recommends blocking the published storage-data.com hosts and IP addresses, restricting outbound TCP 445 and external WebDAV, and searching for the Anyviewer-loader/1.0 and Anyviewer-ipcheck/1.0 user agents. Those indicators are valuable pivots, not a complete campaign boundary. The actor changed staging services, and short windows may have used infrastructure that investigators did not observe.

Mandiant notified AOMEI on July 17 and says the vendor responded on July 29 that corrective actions had been taken. AOMEI's public changelog now lists Backupper 8.5.0, released October 9, and its support documentation offers automatic or manual upgrade paths. Neither page describes the incident or presents the new version as an endpoint disinfectant. Treat the latest installer as software maintenance, not retrospective proof of integrity.

Inventory every system that ran AOMEI Backupper or shared update components during the April-to-July period, including systems that are no longer online. Search historical process creation for ABNotify.exe launching executables from the html hierarchy, the RadminComponentRuntime task, published hashes and domains, side-loaded DLLs, suspicious dllhost.exe behavior, public IP lookup patterns, and outbound WebDAV or SMB. Preserve files and logs before cleanup because the loader intentionally removed or reverted artifacts.

Where the chain executed, isolate the host and recover from a trusted baseline. Scope the user and service identities active on it, review credentials and tokens stored or used there, and investigate adjacent systems reached after the suspected time. Updating, uninstalling, or reinstalling AOMEI alone does not remove an independent backdoor or undo credential exposure. The durable control is a monitored update boundary: signed configuration and artifacts, isolated testing, process-behavior alerts, egress limits, and retained telemetry long enough to reconstruct a five-minute event.