Attackers Tampered with AOMEI Update Servers to Deliver Backdoors
Hackers compromised update servers to distribute malicious payloads via legitimate software update channels.
1Compromised Update Mechanism
Attackers repeatedly modified two configuration files, down_html.ini and Notifycfg.ini, on AOMEI Backupper update servers between May and July 2026. These files lacked cryptographic verification, allowing the software to download and execute malicious packages. The process operated within five to ten-minute windows, effectively bypassing standard automated file scanning and point-in-time security triage.
2Stealthy Backdoor Deployment
The malicious package, identified as CROSSROAD, unpacked a signed copy of Radmin and a secondary implant named SHINYROAD. This implant provides a remote shell and can execute arbitrary code on command. The backdoor maintains persistence through a scheduled task that runs every three hours, while the initial downloader deletes itself from the disk.
3Credential Theft via WebDAV
During a July 20 incident, attackers utilized a secondary technique involving an invisible one-pixel pop-up. This triggered a WebDAV request, forcing Windows to leak the logged-in user's NetNTLMv2 authentication token to an external server. This method required no program execution, potentially compromising credentials even on systems where the primary backdoor was successfully blocked.
4Global Impact and Targeting
Google Threat Intelligence Group identified affected organizations across 11 countries, including Türkiye, the United States, and Singapore. The victims span critical sectors such as telecommunications, higher education, and IT services. The campaign is attributed to the threat actor UNC7017, which remains unidentified regarding its specific country of origin or affiliation.
5Evasion and Security Checks
The malware includes environmental awareness, terminating execution if it detects specific security agents or identifies the machine's location as China. On systems that pass these checks, attackers deployed the open-source Adaptix C2 framework disguised as Nitro PDF software. This sophisticated layering allowed the attackers to maintain control while remaining hidden from traditional detection.
6Vendor Response Limitations
AOMEI Technology reported securing its servers by late July, but this action does not remove backdoors from already infected machines. The downloader restores the local update files to their genuine state after execution, causing infected systems to appear normal. Consequently, the vendor's current download page does not reflect the historical compromise of previous versions.
7Detection and Forensic Challenges
Analysts have frequently dismissed legitimate detections as false alarms because the server-side files revert to genuine content within minutes. Security teams are urged to hunt for indicators across the entire April-to-July period. Forensic investigation must focus on cached files within the program's local folders and network logs rather than current server states.
8Recommended Mitigation Strategies
Organizations should block the identified attacker infrastructure and restrict outbound SMB and WebDAV traffic to external addresses. Security teams are advised to implement YARA and Sigma rules provided by researchers to detect residual activity. Relying on vendor-side fixes is insufficient; proactive threat hunting and rigorous endpoint monitoring remain essential for remediation.