As reported by BleepingComputer, threat actor UNC7017 compromised AOMEI's update infrastructure between April and July 2026, distributing a novel downloader (CROSSROAD) and backdoor (SHINYROAD) through AOMEI Backupper's built-in promotional and notification systems. What makes this campaign particularly notable isn't just the supply chain compromise itself — it's the ephemeral nature of the attack.
The Disappearing Config Trick
Most supply chain attacks we've analyzed involve persistent tampering — malicious updates that remain live until discovered. UNC7017 flipped this playbook. By briefly modifying two configuration files (down_html.ini and Notifycfg.ini) on AOMEI's servers and then restoring them to their original state, the attackers created a narrow infection window that left almost no server-side forensic trace.
This is significant because it fundamentally challenges our detection assumptions. Organizations that relied on monitoring AOMEI's servers for anomalous configurations would find nothing wrong in retrospective analysis. The malicious window was so brief that standard update-mirroring or caching mechanisms likely never captured the tampered versions. The attack effectively weaponized the gap between when software checks for updates and when defenders audit infrastructure.
Why the Promotional Feature Vector Matters
The abuse of AOMEI Backupper's promotional download and notification system — a feature designed to display marketing content and update prompts — represents an underappreciated attack surface. Many enterprise applications include telemetry, notification, or promotional subsystems that phone home to fetch dynamic content. These channels are often:
- Whitelisted at the network layer, bypassing egress filtering
- Trusted by the application itself, executing fetched content without integrity verification
- Poorly monitored, since security teams focus on core update mechanisms, not ancillary features
UNC7017 recognized that the notification system could trigger code execution on the endpoint without user interaction, making it an ideal silent delivery mechanism. The initial deployment of Radmin — a legitimate remote administration tool — as the first-stage payload is a classic living-off-the-land technique designed to blend in with normal administrative activity.
Who Is at Risk
AOMEI Backupper has substantial enterprise deployment, particularly among small-to-midsize organizations that use it for Windows disk imaging, bare-metal recovery, and workstation backup. The confirmed victims span IT services, telecommunications, and higher education across six countries, but Google's assessment that the campaign was opportunistic suggests the actual footprint is larger. Any organization whose endpoints checked for AOMEI updates during the active windows — even briefly — should assume potential exposure.
Shield53 Recommendations
- Audit for AOMEI Backupper installations across all endpoints using EDR inventory or software asset management tools. Document version numbers and last update check timestamps.
- Look for Radmin (
radmin.exe,rserver32.exe) on systems running AOMEI Backupper, especially if installed between April–July 2026. Radmin is rarely deployed in modern enterprise environments and its presence alongside AOMEI software is a strong compromise indicator. - Hunt for CROSSROAD and SHINYROAD artifacts. Work with your threat intelligence provider or Google's published IOCs to build detection rules for these previously unknown malware families.
- Block or restrict AOMEI update/notification domains (
*.aomeisoftware.com,*.aomeitech.com) at your proxy or DNS filtering layer until AOMEI provides a formal security advisory confirming their infrastructure is clean. - Disable or restrict promotional/notification features in any enterprise software where such capabilities exist. These ancillary features provide minimal business value and introduce unnecessary remote content execution risk.
- Demand a formal vendor response from AOMEI. As of the report's publication, there is no indication AOMEI has issued a security advisory or confirmed the scope of the compromise. Vendors must be transparent about infrastructure incidents.
- Reassess third-party software update trust models. If your organization still permits applications to self-update without centralized package validation, this incident is your wake-up call. Channel all updates through a controlled internal repository with integrity verification.
The ephemeral config hijack technique demonstrated by UNC7017 is likely to be replicated by other threat actors. Defenders must assume that any dynamic content fetched by trusted applications — not just core update binaries — is a potential attack vector.
Shield53 assesses this campaign as a high-impact event with moderate-to-high likelihood of broader victim identification as more organizations review historical telemetry. The combination of trusted vendor infrastructure, legitimate tool abuse (Radmin), and vanishing configuration changes makes this one of the more sophisticated supply chain operations observed in 2026.
