Google uncovers brief AOMEI supply chain malware attack

Google's Threat Intelligence Group and Mandiant said they had uncovered a software supply chain compromise affecting AOMEI's update infrastructure. The activity ran between April and July and was linked to a threat cluster tracked as UNC7017.

The incident centred on repeated tampering with AOMEI origin servers that host configuration files used by products including AOMEI Backupper and AnyViewer. The attacker altered those files for bursts lasting just five to 10 minutes before restoring legitimate versions, a tactic that helped the operation evade routine checks and automated scanning.

Those short windows meant only systems that polled the servers at the exact time of tampering received malicious instructions. Systems checking before or after the changes would have seen authentic files, making the compromise harder to confirm after the fact.

Google said it had not previously encountered a software supply chain attack carried out in such brief intervals. The approach reduced the chance of detection by both vendors and defenders because later checks of the same update locations would often show clean files.

Investigators said the campaign delivered a multi-stage malware chain involving a downloader called CROSSROAD and a backdoor known as SHINYROAD. The attacker first redirected software to fetch a malicious archive from external infrastructure, then used AOMEI's notification mechanism to trigger execution on the local machine.

According to the findings, the altered update settings changed the download location for a ZIP package called upgrade-now.zip and updated the expected MD5 value so the client would accept it. At the same time, the attacker modified a separate notification configuration file so the software would run the downloaded executable immediately.

In one observed version of the attack, the notification file was padded with more than 35,000 repetitive configuration entries. This was designed to override standard version checks and force the client to trigger the update regardless of the installed version.

Infrastructure shifts

The staging infrastructure changed several times during the campaign. Early payloads used Alibaba Cloud object storage before the operation moved to domains designed to resemble vendor traffic, including storage-data.com and promotion.storage-data.com.

Later, one tampering window directed the initial download to a public Google Cloud Storage bucket while keeping follow-on payload retrieval on an actor-controlled domain. Researchers said that split may have helped the first-stage download pass through company proxy controls that block newly registered domains.

The campaign also included a separate credential theft technique. In one observed case, the attacker replaced a visible promotional banner in AOMEI's notification system with an invisible 1x1 pixel window that called a remote file over WebDAV.

That forced affected systems to attempt authentication against an attacker-controlled server, potentially exposing NetNTLMv2 hashes without any visible prompt to the user. The mechanism meant organisations could face credential theft even if malware execution was blocked.

Victims and discovery

Based on available telemetry, affected organisations were identified across IT services, telecommunications and higher education, among other sectors. Countries named in the investigation included Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States.

The victim profile appeared opportunistic because any system polling AOMEI's update servers during the short tampering periods could receive the malicious files. As a result, the number of affected organisations was likely broader than those directly observed.

The activity was first detected through joint work with the ManageEngine Threat Analysis Lab, part of Zoho. Endpoint telemetry picked up the operation across several customer environments in late May, after which Google said it notified potentially affected organisations and shared its findings with AOMEI.

AOMEI told the researchers it had taken corrective action to secure its distribution servers. The findings also warned that server-side fixes alone would not clean endpoints that had already downloaded the malicious updates during earlier tampering windows.

Persistence risks

Once executed, CROSSROAD established persistence through a scheduled task named RadminComponentRuntime and then deployed SHINYROAD through trojanised administration utilities. Later stages also used software associated with Nitro PDF as cover for another post-exploitation tool linked to the Adaptix command-and-control framework.

Researchers said the use of signed or legitimate software alongside malicious DLLs could complicate analysis because defenders might dismiss the activity as ordinary remote administration or user-installed software. The malware also attempted to remove traces by restoring local configuration states and deleting the initial loader.

“Because the tampering occurred in brief, short bursts, systems that received these files may remain compromised without the organisation's knowledge unless proactive endpoint hunting and remediation are performed,” Google said.