AOMEI Backupper software compromised in supply chain attack

Security researchers have identified a supply chain campaign targeting AOMEI Backupper and AnyViewer software between April and July 2026. The threat actor, tracked as UNC7017, utilized short-lived tampering windows of only five to ten minutes to distribute malware, including the CrossRoad downloader and the ShinyRoad backdoor.

By manipulating unauthenticated configuration files used for background updates and promotional notifications, attackers redirected software downloads to malicious ZIP archives. This allowed the malware to pass integrity checks by providing matching checksums for the compromised packages. The campaign appeared opportunistic, affecting any system that checked for updates during these brief windows.

Investigations by Google Threat Intelligence Group, Mandiant, and ManageEngine Threat Analysis Lab (METAL) identified compromised entities in sectors such as telecommunications, IT services, and higher education. Affected regions include the United States, Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, and Türkiye.