Between April and July, AOMEI Backupper served malware to its customers a number of instances in short-burst provide chain compromises, safety researchers warn.
AOMEI Backupper is Home windows backup, sync, and disk cloning software program, accessible in free and paid editions for house customers, companies, and Home windows Server environments. AOMEI says its merchandise are utilized by greater than 186 million folks worldwide.
Not like typical provide chain assaults, this marketing campaign relied on short-lived tampering home windows to serve the CrossRoad downloader and the ShinyRoad backdoor.
“Every tampering window remained energetic for less than 5 to 10 minutes earlier than reverting to genuine variations,” report Google Cloud’s Google Risk Intelligence Group (GTIG) and Mandiant, which investigated the assault alongside ManageEngine Risk Evaluation Lab (METAL).
The assaults hit all techniques that fetched the modified AOMEI Backupper packages throughout the assault home windows, suggesting an opportunistic marketing campaign reasonably than a focused one.
Nonetheless, all through the investigation, Google Cloud recognized larger training, IT providers, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the US which were compromised.
“We confirmed a number of tampering home windows in 2026, alongside associated malware samples noticed within the wild beginning in late April. Nonetheless, given the brief period of those home windows, it’s possible that further tampering occurred all through the marketing campaign that remained outdoors our visibility,” Google Cloud notes.
Throughout the very brief assault home windows, the menace actor, tracked as UNC7017, tampered with the replace server’s replace settings file to redirect to a malicious ZIP archive and modified the server’s computerized notification service to pressure techniques into mechanically executing the malware.
METAL’s evaluation of the incident reveals that the hackers abused AOMEI Backupper’s promotional content material channel for malware distribution. The channel runs background providers that ballot AOMEI’s servers for content material and consists of two configuration paths that ship content material to a listing and execute it.
“The 2 paths converge on the identical location. One controls what lands in html; the opposite controls what may be executed from it. Neither configuration file is cryptographically authenticated by the shopper, and the checksum used to validate the archive is said inside the identical unauthenticated file that names it,” METAL explains.
ManageEngine’s menace analysts caught a glimpse of the potential assault path on Might 28, and noticed in actual time the change in payloads served by AOMEI on July 16. On July 20, the short-burst tampering was additionally caught by Mandiant.
Evaluation of the payload confirmed the supply of a reliable model of the Radmin Server distant administration software alongside a malicious DLL loaded by way of it that will set up a reverse TCP connection to the attackers’ command-and-control (C&C) server.
Google Cloud’s researchers additionally noticed UNC7017 introducing a secondary exploitation vector, changing a reliable banner with a 1×1 pixel window assigned most execution precedence that compelled the AOMEI shopper to request a distant useful resource by way of WebDAV, thus sending NetNTLMv2 authentication hashes to the attackers.
All through the assorted phases of the marketing campaign, the menace actor delivered a number of payloads, together with the CrossRoad dropper, a modified model of Radmin Server, and the Adaptix C&C framework.
CrossRoad was seen performing system validation, cleanup, and payload staging, establishing persistence for the late-stage backdoor, and deleting itself from the disk. The ultimate payload was the ShinyRoad modular backdoor framework.
In July, after the profitable deployment of ShinyRoad, UNC7017 was seen dropping AdaptAgent, which is a part of the Adaptix C2 post-exploitation framework.
“This marketing campaign highlights a broader evolution in software program provide chain assault methodologies. Provide chain intrusions have traditionally centered on inserting backdoors into software program supply code or tampering with developer construct pipelines. UNC7017’s use of ephemeral configuration tampering represents a lower-overhead, higher-stealth various,” Google Cloud notes.
METAL says it initially notified AOMEI Expertise of the potential tampering in early June, however the vendor dismissed the report, claiming the content material was seemingly intercepted and modified in transit. Google Cloud notified it once more in mid-July, and the corporate mentioned in late July that it had taken corrective actions.
Associated: Siemens Software program Middle Vulnerability Exploited in ClickFix Malware Assaults
Associated: Rank Math PRO WordPress Plugin Compromised in Provide Chain Assault
Associated: ConnectWise Suspends Cloud Companies in Response to Cyberattack
Associated: Chinese language APT Exploited BeyondTrust Vulnerability as Zero-Day
