Hackers Tampered With AOMEI Config Files to Spread Malware, Researchers Say
UNC7017 briefly altered AOMEI Backupper's update and notification files to deliver the CROSSROAD downloader and SHINYROAD backdoor, according to a ManageEngine-led investigation.
Hackers compromised AOMEI's servers and briefly modified two configuration files used by AOMEI Backupper to push malware through the software's built-in promotion and notification systems, according to research published by ManageEngine's Threat Analysis Lab in coordination with Google's Threat Intelligence Group and Mandiant, as reported by bleepingcomputer.com.
The activity is attributed to a threat actor tracked as UNC7017, which distributed a previously unknown malware downloader named CROSSROAD and a backdoor named SHINYROAD. Affected organizations were identified in the United States, Australia, India, Singapore, Spain and Switzerland, in the IT services, telecommunications and higher education sectors.
The attackers altered down_html.ini and Notifycfg.ini, redirecting AOMEI Backupper to download a malicious ZIP archive and using the notification mechanism to execute malware without user interaction. They also changed the expected checksum in the update configuration so the malicious archive passed file verification, then restored the configuration files to their original state within minutes.
ManageEngine first detected the attacks on May 28, when its endpoint security software saw AOMEI Backupper install Radmin, a legitimate remote administration tool abused by the attackers, at two unrelated companies in different countries. Researchers identified three exposure windows: May 28 (05:40–05:50 UTC), July 16 (08:33–08:39 UTC) and July 20 (10:35–10:40 UTC). During the July 20 attack, Google observed an attempt to steal Windows authentication hashes via an invisible popup accessing an attacker-controlled WebDAV resource.
Between April and July 2026, supply chain attacks targeted the update and notification systems used by AOMEI Backupper.
Quick answers
What is UNC7017?
UNC7017 is the threat actor tracked by researchers as responsible for the campaign that distributed the CROSSROAD downloader and SHINYROAD backdoor through AOMEI Backupper.
When were the AOMEI Backupper attacks detected?
ManageEngine first detected the attacks on May 28. Researchers identified three exposure windows: May 28, July 16 and July 20.
Which countries were affected?
Affected organizations were identified in the United States, Australia, India, Singapore, Spain and Switzerland, in IT services, telecommunications and higher education.