AOMEI Backupper and AnyViewer Hit by a Supply Chain Attack Delivered in Brief Update Windows

Five to ten minutes, no more. That was the brief window during which attackers hijacked AOMEI's update servers to deliver a backdoor to users of AOMEI Backupper and AnyViewer. Here’s what matters.

AOMEI, the publisher of AOMEI Backupper (backup, disk cloning, and restore on Windows) and AnyViewer (remote access), was targeted by a supply chain attack between April and July 2026. This security incident was detailed in two coordinated reports released last week: one from Google Threat Intelligence Group and Mandiant, and one from the ManageEngine Threat Analysis Lab (METAL). The threat group behind this campaign is tracked as UNC7017.

It all began on May 28, 2026, when ManageEngine's EDR saw AOMEI Backupper install Radmin, a remote administration tool, on two unrelated customers in two different countries. METAL notified AOMEI on June 7. At first, AOMEI told researchers that the content had been intercepted and altered in transit, meaning between its servers and customer endpoints. METAL ruled out that theory: both endpoints had retrieved the content over HTTPS, from hostnames belonging to AOMEI.

The identified victims (IT services, telecom, higher education) are spread across 11 countries, including Spain, Portugal, and Switzerland. France is not mentioned, but that is no guarantee: any system querying AOMEI's servers at the wrong moment could have fetched the malware.

Brief windows that helped the attackers stay under the radar

AOMEI Backupper and AnyViewer regularly query two configuration files hosted by the vendor. The first, down_html.ini, specifies the URL of the archive to download and its expected MD5 hash. The second, Notifycfg.ini, controls notifications and what they launch locally. Neither file is cryptographically authenticated by the client: by changing both the URL and the hash, the attacker can make their archive look legitimate. In other words, the integrity check validates... whatever the attacker tells it to validate.

The booby-trapped archive contained 232 files, including an unsigned executable, upgrade-now.exe. A locally loaded HTML page opened by the application's built-in browser triggered its execution. No vulnerability, no user action: simply launching the application was enough.

What matters here is that the attackers diverted the application's mechanism used to display in-app promotional windows, for example. To display them, it downloads a bundle of HTML and image files (the 232 files in this case), and ABNotify.exe renders them in an embedded browser.

Three tampering windows were confirmed: 10 minutes on May 28, 6 minutes on July 16, and 5 minutes on July 20, before the legitimate files were restored. "This is the first time we have encountered a software supply chain compromise implemented with such short windows," Google wrote in its report. For an analyst checking the update URL after an alert, everything looks clean and the detection can be dismissed as a false positive. That explains the choice to compromise the supply chain for 5 to 10 minutes each time.

CROSSROAD, SHINYROAD, and NetNTLMv2 hash theft

The infection chain then unfolds in several stages:

• CROSSROAD: this downloader checks the environment, retrieves the next payload, creates a scheduled task named RadminComponentRuntime, then deletes itself from disk.
• SHINYROAD: this backdoor hijacks a legitimate signed Radmin executable to load a malicious DLL. It enables remote command execution and on-the-fly code delivery.
• Adaptix C2: starting in mid-July, the agent for this post-exploitation framework was deployed by impersonating a Nitro PDF component (NitroPromotion.exe), with a scheduled task named NitroRuntime.
• Credential leak: on July 20, Notifycfg.ini opened an invisible 1 x 1 pixel window pointing to a remote WebDAV resource. The infected machine then sent the user's NetNTLMv2 hash to the attacker, without any binary being executed.

In a way, this scenario echoes the Notepad++ case, where attackers managed to hijack the update mechanism for 6 months.

If AOMEI Backupper or AnyViewer is present on your machine, it is recommended that you look for possible traces of compromise. In particular, the following indicators of compromise (IoCs) are mentioned:

• Scheduled tasks: look for RadminComponentRuntime and NitroRuntime.
• Files: an executable in the html folder of the AOMEI installation directory does not belong there. Also check the Radmin and Nitro Pro folders under %LOCALAPPDATA%.

One question remains unanswered in both reports: how did UNC7017 gain access to AOMEI's servers?

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio