AOMEI Backupper supply chain attack

Between April and July 2026, a threat actor tracked as UNC7017 executed a supply chain campaign targeting AOMEI Backupper and AnyViewer software. Attackers utilized brief tampering windows of only five to ten minutes to manipulate unauthenticated configuration files on the vendor’s servers.

By altering these files, the attackers redirected software updates to malicious ZIP archives containing the SHINYROAD backdoor and the CrossRoad downloader. Because the software failed to cryptographically verify update instructions or checksums, the malicious packages were installed with system-wide privileges.

Security researchers from Google Threat Intelligence Group, Mandiant, and ManageEngine’s Threat Analysis Lab identified that the campaign affected various sectors, including telecommunications, IT services, and higher education, across multiple regions such as the United States, Australia, Brazil, India, and others. While the vendor has reported fixing the compromised servers, the backdoor remains present on machines infected during the periods of activity.