Inside the AOMEI Supply-Chain Attack: How UNC7017 Hijacked Update Servers to Silently Deploy Backdoors
Executive Summary
Between April and July 2026, threat actor UNC7017 conducted a stealthy supply-chain attack against AOMEI Backupper, a widely deployed Windows backup application, by compromising the vendor's update and notification server infrastructure. Attackers briefly modified two configuration files—down_html.ini and Notifycfg.ini—during three narrow windows lasting five to ten minutes each, redirecting the software to download a malicious ZIP archive and silently execute a novel downloader (CROSSROAD) and backdoor (SHINYROAD) without user interaction. SHINYROAD leveraged legitimate Radmin components to establish outbound C2 connectivity. Affected organizations spanned IT services, telecommunications, and higher education across the United States, Australia, India, Singapore, Spain, and Switzerland.
This incident illustrates a growing attacker preference for ephemeral, low-dwell-time supply-chain tampering that evades traditional perimeter and endpoint defenses. By operating inside trusted vendor delivery channels and restoring malicious files within minutes, UNC7017 exploited the implicit trust organizations place in signed, vendor-distributed software updates—a pattern increasingly observed across enterprise software ecosystems in 2025–2026.
Why This Matters Now
Software supply-chain attacks are accelerating in 2026, with adversaries exploiting the blind trust organizations extend to vendor update mechanisms. Regulatory frameworks including NIST SSDF, EO 14028, and the EU Cyber Resilience Act now mandate software bill-of-materials (SBOM) practices and update-channel integrity verification—making incidents like AOMEI a direct compliance liability for any organization that failed to inspect outbound update traffic or enforce egress policy on backup software communications.
Attack Path Analysis
UNC7017 compromised AOMEI's update and notification infrastructure, briefly modifying configuration files served over HTTPS to redirect AOMEI Backupper clients to download and execute malicious payloads (CROSSROAD downloader and SHINYROAD backdoor) without user interaction during narrow exposure windows of 5–10 minutes. Once installed, CROSSROAD established persistence via scheduled tasks while SHINYROAD used legitimate Radmin components to phone home to attacker-controlled C2 infrastructure, enabling follow-on command execution and potential credential theft via forced NTLM hash exposure through a WebDAV lure.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
UNC7017 gained unauthorized access to AOMEI's server infrastructure hosting the promotion and notification configuration files (down_html.ini and Notifycfg.ini). The attackers also modified the expected checksum in the update configuration to allow the malicious archive to pass file verification checks, indicating server-side write access. The exact initial access vector (e.g., stolen credentials, unpatched vulnerability) was not publicly confirmed by AOMEI.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Masquerading: Match Legitimate Name or Location
Ingress Tool Transfer
Scheduled Task/Job: Scheduled Task
Forced Authentication
Application Layer Protocol: Web Protocols
Obfuscated Files or Information
Remote Access Software
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Supply Chain Protection & Software Integrity Verification
Control ID: SA-12 / SR-3
PCI DSS 4.0 – Software Integrity and Third-Party Component Risk Management
Control ID: Requirement 6.3.3 / 12.3.4
DORA (EU) 2022/2554 – Third-Party ICT Provider Supply Chain Integrity
Control ID: Article 28 – ICT Third-Party Risk Management
NIS2 Directive (EU) 2022/0383 – Security of Supply Chain and Software Development
Control ID: Article 21(2)(d) – Supply Chain Security
CISA Zero Trust Maturity Model 2.0 – Software Supply Chain Integrity and Runtime Validation
Control ID: Application Pillar – Application Security / Supply Chain
ISO/IEC 27001:2022 – Outsourced Development and Supply Chain Information Security
Control ID: Annex A 8.30 / A 5.21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
IT service providers using AOMEI Backupper face supply-chain backdoor exposure via CROSSROAD/SHINYROAD malware, enabling lateral movement and C2 exfiltration risks mapped to NIST.800-53.SC-7 and ZTMM.Network controls.
Telecommunications
Telecom organizations explicitly named as affected targets face NTLM hash theft and persistent backdoor installation, requiring Zero Trust Segmentation and Egress Security enforcement per PCI.4.0.3.5.1 compliance mandates.
Higher Education/Acadamia
Universities identified as confirmed victims risk credential harvesting via WebDAV NTLM coercion and undetected scheduled-task persistence, demanding Multicloud Visibility controls aligned to HIPAA.164.312(b) and NIST.CSF.DE.CM-7.
Computer Software/Engineering
Software vendors and engineering firms dependent on third-party backup tools face supply-chain compromise of update infrastructure, requiring Cloud Native Security Fabric and Inline IPS per NIST.800-53.SI-4 to block malicious payload delivery.
Sources
- Hackers hijack AOMEI update servers to secretly spread malwarehttps://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/Verified
- Investigating Ephemeral Supply Chain Tampering - Google Threat Intelligencehttps://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tamperingVerified
- AOMEI Backupper Supply Chain Compromise - ManageEngine Threat Analysis Labhttps://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Supply Chain Security Guidance - CISAhttps://www.cisa.gov/topics/cyber-threats-and-advisories/supply-chain-securityVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant to this incident because UNC7017 exploited trusted software delivery infrastructure to implant backdoors and establish outbound C2 channels across victim environments. By enforcing segmented workload access, identity-scoped routing, and controlled egress policies, Aviatrix would likely reduce the reachability of implanted malware and constrain the attacker's ability to move laterally or exfiltrate credentials across victim cloud and hybrid environments.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Applying Zero Trust access controls to the content delivery infrastructure would likely reduce the ability of unauthorized actors to reach and modify hosted configuration files, constraining the server-side write access that enabled payload substitution.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation applied to the delivery pipeline would likely constrain how far elevated privileges can propagate, reducing the scope of what a compromised identity could reach or modify within the infrastructure.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement across workload segments would likely constrain the attacker's ability to pivot from infected endpoints to adjacent systems, reducing the reachability of lateral movement paths enabled by SHINYROAD's Radmin-based loader.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and policy enforcement across outbound traffic paths would likely reduce the attacker's ability to successfully blend C2 communications within legitimate cloud storage traffic, constraining the reachability of attacker-controlled endpoints from within victim environments.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies enforced at the workload level would likely constrain outbound WebDAV connections to attacker-controlled infrastructure, reducing the probability that NTLM hash material could be successfully transmitted outside the victim environment.
Even where backdoor implants persist on endpoints, the residual risk to broader cloud and hybrid infrastructure would likely be reduced in scope if segmentation and egress controls constrain the outbound reach and lateral movement capability of those implants.
Impact at a Glance
Affected Business Functions
- Endpoint Backup and Disaster Recovery Operations
- IT Asset Integrity and Software Update Management
- Network Authentication and Credential Security (NTLM hash exposure)
- Remote Access and Administrative Control Infrastructure
Estimated downtime: 7 days
Estimated loss: N/A
Organizations in IT services, telecommunications, and higher education across the United States, Australia, India, Singapore, Spain, and Switzerland were exposed during three brief malicious distribution windows totaling approximately 21 minutes between May and July 2026. Affected endpoints may have received the CROSSROAD downloader and SHINYROAD backdoor, enabling persistent attacker access, command execution, and exfiltration of sensitive corporate data. Additionally, during the July 20 attack window, a WebDAV-based NTLM hash capture technique was observed, potentially exposing Windows authentication credentials for affected domain users. The backdoor established outbound C2 connectivity, meaning any data accessible to the compromised endpoint including backup catalogs, system configurations, user credentials, and business-sensitive files was at risk of exfiltration. Financial loss is listed as $0 due to no publicly confirmed ransom payment or quantified breach cost at time of research, though actual organizational remediation and IR costs are expected to be substantial.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Egress Security & Policy Enforcement (CNSF) with FQDN-based filtering to block outbound connections from endpoints to unknown or newly registered domains such as storage-data[.]com and unexpected cloud storage endpoints, preventing CROSSROAD and SHINYROAD from reaching attacker C2 infrastructure even after initial execution.
- • Deploy Multicloud Visibility & Control with centralized traffic observability to detect anomalous outbound connection patterns from backup software processes, flagging unexpected HTTPS calls to non-AOMEI hostnames or scheduled task creation by software update agents as indicators of supply chain compromise.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policies to restrict which internal workloads and processes are permitted to initiate outbound network connections, ensuring that backup software agents cannot spawn remote administration sessions (e.g., Radmin) or access WebDAV resources outside of approved network paths.
- • Enable East-West Traffic Security controls to monitor and restrict workload-to-workload communication initiated by newly installed or anomalous processes such as CROSSROAD, preventing lateral movement from a compromised backup agent to adjacent systems within the same network segment.
- • Leverage Inline IPS (Suricata) with updated threat signatures to inspect and block known malicious payload delivery patterns associated with supply chain tampering, including detection of malicious ZIP archive downloads, checksum bypass attempts, and NTLM hash coercion traffic targeting attacker-controlled WebDAV servers.
