This cybersecurity news story broke in October 2026. Between May and July 2026, the cluster Google tracks as UNC7017 tampered with AOMEI Backupper's own update servers in 5–10 minute bursts — swapping two unsigned config files so any PC checking for updates in that window downloaded and ran a backdoor. No vulnerability exploited. No click needed. Organizations across 11 countries were hit, and AOMEI's server fix doesn't clean machines already infected. Five questions to check your exposure.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Short answer: if you run AOMEI Backupper (or its sibling AnyViewer, which shares the update flow) and haven't hunted for this, assume exposure until proven otherwise. The tampering windows were tiny — a client checking a minute before or after got clean files — so you can't reason your way out with timing. Hunt the April–July window, check the scheduled-task chain, and rebuild anything suspect from a clean installer.
Direct answer: if any Windows machine in your fleet runs AOMEI Backupper and checked for updates between May and July 2026, treat it as potentially exposed. The tampering windows were only 5–10 minutes, so timing alone cannot clear you. Run the 60-second check below, hunt the scheduled-task chain, and rebuild anything suspect from a clean installer.
Answer for the Windows fleet you defend.
A supply-chain attack compromises trusted software before it reaches you — the vendor's own update servers, build pipeline, or installer. You did everything right (downloaded from the official site, installed the signed update) and still got owned, because the poison was upstream of your defenses.
| Fact | Detail |
|---|---|
| Disclosed by | Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine's Threat Analysis Lab — this week. |
| Actor | UNC7017 — the GTIG-tracked cluster also behind the ConnectWise Cloud Backup tenant compromises. No named state sponsor in the reporting. |
| The technique | Repeated short-burst tampering of AOMEI's own origin servers: 5–10 minute windows between May and July 2026 (three confirmed stretches; defenders are told to hunt April–July). Two unsigned files changed: down_html.ini (names the update package + its checksum) and Notifycfg.ini (drives the pop-up service). No cryptographic verification of either file — the "checksum" sat inside the same unsigned file that named it. |
| Why it worked | Nothing in the software was exploited and no user action was needed beyond having the program installed and running. The attacker only had to change two text files on the server for a few minutes; the updater did the rest, running the package with the AOMEI process's privileges. |
| Payloads | CROSSROAD downloader; SHINYROAD implant launched via a scheduled task running a signed Radmin executable that side-loaded a planted DLL from the same directory; Adaptix C2 disguised as Nitro PDF on some machines; a July 20 variant could leak NetNTLMv2 hashes via an invisible one-pixel WebDAV pop-up without running any program. |
| Scope | Organizations in IT services, telecom, and higher education across 11 countries. AnyViewer — AOMEI's remote-desktop tool sharing the same update flow — may also be affected. |
| Vendor response | AOMEI (AOMEI Technology, registered in Hong Kong) told Mandiant on July 29 it had taken corrective action on its servers. That does not remove implants from already-compromised machines. Neither report names affected versions; ManageEngine has not independently confirmed containment. |
Sources: The Hacker News — "Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor" (Oct 2026) · dev.to technical summary. Facts summarized, not reproduced.
Inventory every machine running AOMEI Backupper — and AnyViewer, which shares the update flow. You can't hunt what you haven't inventoried.
Preserve update files cached in the program's folders and correlate them with network logs from that period. The vendor's current download page shows only clean files now — history is what matters. Look for the scheduled task launching signed Radmin + planted DLL + SHINYROAD, and any Adaptix C2 masquerading as Nitro PDF.
Block the attacker infrastructure named in the reports, and block outbound SMB (TCP 445) and WebDAV to external addresses — that kills the NetNTLMv2 credential-theft technique outright.
A server-side fix never touches an implanted machine. Rebuild affected hosts from a known-clean installer (fresh download, verified), and rotate every credential those machines held after rebuilding, in dependency order.
Between May and July 2026, attackers repeatedly altered two unsigned files on AOMEI's own update servers — down_html.ini and Notifycfg.ini — for five to ten minutes at a time. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran the attacker's package. Disclosed by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab; attributed to the cluster GTIG tracks as UNC7017.
No. According to ManageEngine's lab, nothing in the software was exploited and no user action was needed beyond having the program installed and running. The updater never cryptographically verified the files it fetched — the checksum meant to prove the download genuine sat inside the same unsigned file that named it.
The CROSSROAD downloader and the SHINYROAD implant, launched through a signed Radmin executable side-loading a planted DLL from the same directory via a scheduled task. Some machines also received Adaptix C2 disguised as Nitro PDF software. A July 20 change could also leak NetNTLMv2 authentication hashes through an invisible one-pixel WebDAV pop-up without running any program.
AOMEI told Mandiant on July 29 that it took corrective action on its servers — but that fix does not remove the backdoor from machines already compromised. Neither report names which Backupper versions are affected, and ManageEngine said it had not independently confirmed containment. Infected machines remain compromised until investigated and rebuilt.
Hunt across April–July for compromise: preserve cached update files, review network logs, inspect scheduled tasks for the Radmin/DLL/SHINYROAD chain, block the attacker infrastructure and outbound SMB and WebDAV to external addresses, then rebuild affected machines from a clean installer and rotate credentials.