For a few minutes at a time, the update servers behind AOMEI's backup and remote-access software quietly handed out malware. Anyone whose copy of AOMEI Backupper or AnyViewer happened to check for updates during one of those windows got a trojanized package and a backdoor. Anyone who checked a few minutes earlier or later got the genuine file.
That is the finding of a new investigation by Google Threat Intelligence Group (GTIG) and Mandiant, written by Tyler McLellan, into a supply chain campaign that ran against AOMEI Technology's update infrastructure from April to July 2026. GTIG attributes the activity to a cluster it tracks as UNC7017 and says this is the first time it has seen a software supply chain compromise built around such short tampering windows, which defeat point-in-time triage and automated file scanning. The activity was first spotted in late May by the ManageEngine Threat Analysis Lab (METAL), part of Zoho, whose endpoint telemetry flagged it across several customer environments.
Victims were whoever polled at the wrong minute
GTIG identified affected organizations in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. Because the attacker served malware to any client that polled during a tampering window, GTIG describes the victimology as opportunistic and likely broader than what it directly observed.
The researchers confirmed three windows: 10 minutes on May 28, six minutes on July 16 and five minutes on July 20. At the end of each, UNC7017 restored the two configuration files the software reads: down_html.ini, which tells the client where to fetch an update and what its MD5 hash should be, and Notifycfg.ini, which tells the notification process what to display and run. GTIG says it is probable that further windows occurred outside its visibility.
No software bug was needed
The attacker abused the update logic exactly as designed. During a window, it pointed the update URL at an attacker server, bumped the build number and supplied a matching MD5 so the client would accept the package. On July 16 it also padded Notifycfg.ini with more than 35,000 lines of dummy sections, which GTIG says forced the client to update regardless of its installed version and immediately run the dropper. On July 20 it added a second trick: an invisible 1x1 pixel popup that loaded a file over WebDAV from 8[.]210[.]84[.]56, a way to coerce Windows into sending NetNTLMv2 password hashes to the attacker without the user seeing anything.
The payload chain starts with CROSSROAD, a downloader written in C that checks its own path contains "AOMEI", aborts its main payload path in some branches if the machine geolocates to China, resets the local update settings to cover its tracks, and installs a scheduled task named RadminComponentRuntime. That task launches a legitimate, signed Radmin binary that side-loads a malicious DLL, which in turn runs SHINYROAD, a modular backdoor delivered as Python bytecode and executed inside an embedded PocketPy interpreter. Other waves added a modified Radmin Server and the Adaptix C2 agent, the latter disguised as Nitro PDF tooling. Staging moved from Alibaba Cloud storage to lookalike domains and then to a Google Cloud Storage bucket, which GTIG says helped the first download slip past filters that block newly registered domains.
Update channels have been abused this way before, as in the ViPNet update hijack against Russian networks, and Radmin has turned up in covert-access operations such as the campaign that turned Korean PCs into proxies.
Hunt for unsigned children of the AOMEI updater
AOMEI told GTIG it has taken corrective action to secure its distribution servers. GTIG advises defenders to profile updater behaviour, watching for unsigned child processes spawned by background update runners and for unexpected network redirection from trusted desktop software. Organizations running AOMEI Backupper or AnyViewer should check for the artifacts below and review outbound NTLM authentication to external hosts.
- Scheduled tasks: RadminComponentRuntime (runs %LOCALAPPDATA%\Radmin\FamItrfc.exe --runtimechk) and \NitroRuntime
- Mutex: Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}
- CROSSROAD (upgrade-now.exe) SHA256: 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450
- Domains: storage-data[.]com, promotion[.]storage-data[.]com, aomei[.]storage-data[.]com
- Staging: hxxps://storage[.]googleapis[.]com/aomeiupdate/upgrade-now[.]zip
- C2 and NTLM capture: 8[.]210[.]84[.]56, 8[.]218[.]65[.]184
The uncomfortable point in GTIG's report is that a supply chain attack no longer has to leave a poisoned binary in an official release for someone to find later. A few minutes of tampering, cleaned up afterwards, was enough to reach organizations on five continents.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.