AnswersPublished21 sources
AOMEI Backupper Supply-Chain Attack: What Happened and What Users Should Check
Attackers used brief update server tampering between April and July 2026 to deliver CROSSROAD and the SHINYROAD backdoor through AOMEI Backupper. ManageEngine detected suspicious Backupper activity on May 28 and warned AOMEI in June; Google Threat Intelligence Group and Mandiant later tracked the campaign as UNC7017...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Attackers used brief update server tampering between April and July 2026 to deliver CROSSROAD and the SHINYROAD backdoor through AOMEI Backupper.
- ManageEngine detected suspicious Backupper activity on May 28 and warned AOMEI in June; Google Threat Intelligence Group and Mandiant later tracked the campaign as UNC7017.[16][17]
- Restoring the vendor’s files does not establish that a computer is clean. Organizations using Backupper during the campaign period should investigate their endpoints, not just check the confirmed dates.[5][11]
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is known about the April–July supply-chain malware campaign against Hong Kong-registered AOMEI’s Windows backup tool, Backupper, includ. Article summary: The available evidence supports an April–July 2026 supply-chain campaign in which attackers briefly altered AOMEI Backupper’s update infrastructure to deliver malware, including the SHINYROAD backdoor.[2][3][5] The confi. Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
Attackers tampered with AOMEI Backupper’s update infrastructure during a campaign spanning April to July 2026, using brief windows to deliver malware including the SHINYROAD backdoor. Researchers confirmed three tampering episodes lasting ten, six, and five minutes, but cautioned that additional windows may have gone unobserved.17
35
11 A clean-looking update server does not rule out malware already installed on a customer’s computer.
5
9
How the campaign came to light
ManageEngine’s endpoint security software first detected suspicious activity on May 28, when Backupper installed the legitimate remote-administration tool Radmin on two unrelated customers’ computers in different countries. ManageEngine said it warned AOMEI in June. Google Threat Intelligence Group and Mandiant later investigated the activity with ManageEngine and tracked the attackers as UNC7017; the supplied reporting does not attribute the cluster to a country.16
17
40
On October 20, The Record reported that AOMEI had said it had not yet identified or notified customers infected in the attack.16
How attackers used the update and notification systems
Researchers reported that attackers altered two server-side configuration files, down_html.ini and Notifycfg.ini, which were involved in Backupper’s update and notification processes. When software checked in during a tampering window, the altered configuration could direct it to malicious content.17
7
The confirmed windows were May 28, July 16, and July 20, lasting ten, six, and five minutes, respectively. Attackers restored the legitimate files afterward. Researchers believe more tampering may have happened than they directly observed, so those three episodes should not be treated as a complete list of possible exposure dates.35
11
The malware chain included CROSSROAD, a downloader that unpacked a payload bundle and set up a scheduled task to run every three hours. A signed Radmin executable then side-loaded a malicious DLL that loaded SHINYROAD, a backdoor capable of remote-shell and command-execution activity.35
33
What is known—and what remains uncertain—about the impact
Reporting identified affected organizations in sectors including IT services, telecommunications, and higher education, across more than ten countries.40 The available evidence does not establish the full number of infected devices or organizations. The short delivery windows and warning that further episodes may have gone undetected make the confirmed dates an incomplete basis for estimating exposure.
11
16
CROSSROAD also performed checks related to its execution environment and location; reporting describes it avoiding its main payload path on systems geolocated to China.1
9 The supplied reporting does not provide enough reliable detail to establish every exclusion or to treat other alleged behaviors as confirmed here.
What Backupper users should do
Organizations that used Backupper during April–July 2026 should investigate relevant computers across the entire period, rather than limiting checks to the three confirmed windows. The campaign’s broad timeframe and the possibility of unobserved tampering mean those dates cannot rule out exposure at other times.2
11
Investigations should look for existing malware and persistence on endpoints. Restoring legitimate files on the vendor’s server does not remove an implant already installed on a computer.5
9 This is especially important given the October report that AOMEI had not yet identified or notified infected customers.
16
The campaign illustrates why compromised software-update channels are consequential: malicious activity can arrive through software a customer already uses and trusts. In this case, researchers reported that the malware chain also used a signed Radmin executable to load a malicious DLL.17
33
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "AOMEI Backupper Supply-Chain Attack: What Happened and What Users Should Check"?
Attackers used brief update server tampering between April and July 2026 to deliver CROSSROAD and the SHINYROAD backdoor through AOMEI Backupper.
What are the key points to validate first?
Attackers used brief update server tampering between April and July 2026 to deliver CROSSROAD and the SHINYROAD backdoor through AOMEI Backupper. ManageEngine detected suspicious Backupper activity on May 28 and warned AOMEI in June; Google Threat Intelligence Group and Mandiant later tracked the campaign as UNC7017.[16][17]
What should I do next in practice?
Restoring the vendor’s files does not establish that a computer is clean. Organizations using Backupper during the campaign period should investigate their endpoints, not just check the confirmed dates.[5][11]