Five Minutes Was All It Took: How UNC7017 Weaponized AOMEI Backupper's Update Channel to Backdoor Organizations in 11 Countries
Executive Summary
Between May and July 2026, a threat actor tracked as UNC7017 conducted a precision supply-chain attack against AOMEI Backupper, a widely deployed Windows backup and disk-cloning tool. Attackers gained write access to AOMEI's update servers and swapped two unsigned configuration files—down_html.ini and Notifycfg.ini—during three windows lasting five to ten minutes each. Any copy of the software that polled for updates during those windows silently downloaded and executed a backdoor called SHINYROAD, delivered via a DLL-sideloading chain using a signed Radmin binary. Affected organizations span IT services, telecommunications, and higher education across 11 countries, and a secondary WebDAV trick enabled NetNTLMv2 credential theft with no code execution required.
This incident crystallizes a maturing attacker playbook: compromise the trusted update mechanism of a legitimate vendor, operate in sub-ten-minute windows to defeat point-in-time scanning, and leave no exploited CVE to patch. As software supply-chain intrusions grow more ephemeral and harder to triage, organizations face mounting pressure from CISA, NIST CSF 2.0, and PCI DSS 4.0 to enforce cryptographic verification of software updates and apply zero-trust network controls around all outbound software delivery paths.
Why This Matters Now
Software supply-chain attacks exploiting unsigned update channels are accelerating in 2025–2026, with UNC7017's AOMEI campaign demonstrating that server-side tampering lasting under ten minutes can defeat traditional antivirus, automated file scanning, and vendor-side remediation simultaneously. CISA's Secure by Design guidance and PCI DSS 4.0 deadlines make cryptographic update verification and outbound egress controls an immediate compliance obligation, not a future roadmap item.
Attack Path Analysis
Attackers gained covert write access to AOMEI's update servers and replaced two unsigned configuration files during brief windows of five to ten minutes, causing any running instance of AOMEI Backupper that polled for updates during those windows to automatically download and execute a backdoor (CROSSROAD) with the privileges of the AOMEI service. CROSSROAD deployed the SHINYROAD implant via a signed Radmin binary and a malicious sideloaded DLL, established a persistent scheduled task for recurring remote access, and in one window also triggered a WebDAV-based NetNTLMv2 credential capture with no code execution required, while follow-on tooling including the Adaptix C2 framework was pushed to selected victims for deeper access.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers obtained unauthorized write access to AOMEI's update server infrastructure — likely through compromised server credentials or a backend web management vulnerability — and modified two unsigned plain-text configuration files (down_html.ini and Notifycfg.ini) served over HTTPS. Because AOMEI Backupper performs no cryptographic signature verification of these files or the update package they reference, any installation that polled during a tampering window silently downloaded and executed the attacker's payload without any user interaction or vulnerability exploitation in the client software.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Masquerading: Match Legitimate Name or Location
Hijack Execution Flow: DLL Side-Loading
Scheduled Task/Job: Scheduled Task
Application Layer Protocol: Web Protocols
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Command and Scripting Interpreter
Obfuscated Files or Information
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Software, Firmware, and Information Integrity
Control ID: SI-7
PCI DSS 4.0 – All System Components Are Protected from Known Vulnerabilities
Control ID: Requirement 6.3.3
DORA (EU) 2022/2554 – Supply Chain and Third-Party Software Integrity Controls
Control ID: Article 28 – ICT Third-Party Risk Management
NIS2 Directive (EU) 2022/0383 – Supply Chain Security and Software Integrity
Control ID: Article 21 – Cybersecurity Risk Management Measures
CISA Zero Trust Maturity Model 2.0 – Continuous Validation of Software Execution and Update Integrity
Control ID: Applications Pillar – Application Security
ISO/IEC 27001:2022 – ICT Supply Chain Security and Software Integrity Assurance
Control ID: Annex A 8.30 – Outsourced Development / A 5.21 – Managing Information Security in the ICT Supply Chain
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
IT services firms are prime targets of this AOMEI Backupper supply-chain attack; SHINYROAD backdoor enables lateral movement and exfiltration, demanding Zero Trust Segmentation and egress enforcement per NIST.800-53.SC-7.
Telecommunications
Telecom operators confirmed among affected organizations across 11 countries; CROSSROAD downloader and NetNTLMv2 credential harvesting expose network infrastructure requiring encrypted traffic controls and anomaly detection per NIST.CSF.DE.CM-1.
Higher Education/Acadamia
Universities explicitly identified in GTIG telemetry as compromised targets; decentralized endpoints running AOMEI software face persistent SHINYROAD implant risk requiring multicloud visibility and microsegmentation per HIPAA and PCI compliance frameworks.
Computer/Network Security
Security vendors and MSSPs face reputational and operational risk as ephemeral supply-chain tampering bypasses automated scanning; egress policy enforcement and inline IPS Suricata signatures are critical mitigations per NIST.800-53.SI-4.
Sources
- Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoorhttps://thehackernews.com/2026/10/attackers-tampered-with-aomei.htmlVerified
- Investigating Ephemeral Supply Chain Tampering - Google Threat Intelligence Group / Mandianthttps://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tamperingVerified
- AOMEI Backupper Supply Chain Compromise - ManageEngine Threat Analysis Labhttps://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.htmlVerified
- AOMEI Backupper Official Changeloghttps://www.ubackup.com/changelog.htmlVerified
- Russian Ransomware Gangs Weaponize Open-Source Adaptix C2 Framework - The Hacker Newshttps://thehackernews.com/2025/10/russian-ransomware-gangs-weaponize-open.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This supply chain attack exploited the trust relationship between AOMEI update infrastructure and endpoint installations, allowing backdoor delivery and credential theft across organizations globally. Aviatrix Zero Trust CNSF would likely reduce attacker reach by constraining outbound update traffic to verified destinations, limiting workload-to-workload reachability, and restricting unauthorized egress paths used for credential exfiltration and C2 callbacks.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-level policy could likely constrain workload reachability to update infrastructure by enforcing identity-aware routing, so that only explicitly permitted source workloads may reach AOMEI update endpoints, reducing the exposed surface that a tampered update server could exploit across the environment.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what an elevated service process could reach within the environment, reducing the blast radius of any privilege gained, since workload-level isolation policies could limit lateral reachability even from a high-privilege context on a compromised host.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely limit an implanted workload's ability to reach adjacent hosts or internal services, reducing the attacker's capacity to pivot from an initially compromised endpoint toward higher-value internal targets even after Adaptix C2 was deployed.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and policy control would likely surface anomalous outbound connection patterns from workloads attempting to reach hard-coded external IP addresses, and could constrain those communication paths, reducing the reliability of recurring C2 callbacks that SHINYROAD and Adaptix depended on for persistent remote access.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely constrain outbound SMB and WebDAV traffic to external attacker-controlled addresses, reducing the likelihood that auto-triggered credential hash transmission could successfully reach its destination and limiting the attacker's ability to collect usable authentication material at scale.
Where prior CNSF controls would have reduced attacker reachability across stages, any residual implanted hosts would likely face a substantially constrained operating environment, with limited east-west access to adjacent workloads and restricted outbound paths reducing the attacker's ability to execute broad follow-on operations such as mass data access or ransomware deployment.
Impact at a Glance
Affected Business Functions
- Endpoint Backup and Disaster Recovery Operations
- IT Infrastructure Management and Remote Administration
- Corporate Network Credential Security (NetNTLMv2 credential exposure via WebDAV)
- Managed IT and Telecommunications Service Continuity
Estimated downtime: 7 days
Estimated loss: N/A
Affected organizations across IT services, telecommunications, and higher education in 11 countries faced exposure of Windows endpoint credentials (NetNTLMv2 authentication tokens harvestable via a one-pixel WebDAV pop-up trick requiring no user interaction), persistent remote shell access via the SHINYROAD implant, and potential exfiltration of any data accessible to the compromised AOMEI process. The CROSSROAD downloader installed a scheduled task providing recurring attacker access every three hours. Secondary deployment of the Adaptix C2 framework suggests staged data collection and lateral movement. The full scope of data accessed is unconfirmed, but the attacker had broad system-level privileges on compromised hosts.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Egress Security & Policy Enforcement (CNSF) to block outbound connections to unauthorized destinations including attacker C2 IPs (8.210.84[.]56, 8.218.65[.]184, 47.239.60[.]117) and unknown domains; enforce FQDN-based egress filtering and block outbound SMB (TCP 445) and WebDAV to external addresses to prevent NetNTLMv2 credential theft via the July 20 WebDAV trick.
- • Deploy Multicloud Visibility & Control to baseline and monitor update-related outbound traffic from software agents such as AOMEI Backupper, alerting on anomalous or unexpected callback patterns, new scheduled task creation, and sideloaded DLL activity that deviate from known-good software behavior.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policy to restrict AOMEI service processes to only necessary network destinations and prevent them from installing software outside defined application directories, limiting the blast radius of any future supply chain compromise that abuses service-level privileges.
- • Use Cloud Native Security Fabric (CNSF) inline enforcement and real-time inspection to detect and block the delivery of unsigned or unverified update payloads fetched by background software agents, treating any update mechanism that lacks cryptographic verification as an untrusted ingress path requiring inspection before execution is permitted.
- • Activate Inline IPS (Suricata) with rules targeting known SHINYROAD and Adaptix C2 signatures, CROSSROAD dropper patterns, and YARA/Sigma detections published by GTIG and ManageEngine to identify implant traffic at the network layer, and cross-reference endpoint hunt results for scheduled tasks (RadminComponentRuntime, NitroRuntime), Radmin staging folders, and unsigned executables carrying AOMEI publisher metadata across the full April–July 2026 exposure window.
