UNC7017 Supply Chain Attack via AOMEI Backupper Update Infrastructure

Between May and July 2026, the threat actor UNC7017 conducted a sophisticated, short-lived supply chain attack against AOMEI Technology. By gaining unauthorized access to AOMEI update servers, the attackers repeatedly replaced configuration files (down_html.ini and Notifycfg.ini) for short windows of 5-10 minutes. Because the AOMEI Backupper software lacks cryptographic verification for these update files, compromised clients automatically downloaded and executed malicious payloads delivered via the update flow.

The campaign avoided detection by reverting the server-side configuration to legitimate files immediately after the malicious windows, ensuring that triage attempts checking the vendor's site would appear clean. The attack targets included organizations in IT services, telecommunications, and education across 11 countries. The campaign notably utilized both binary implants and a non-executable WebDAV-based NTLM credential harvesting technique. AOMEI has reported taking corrective server-side actions, but no software update has been released to address the lack of cryptographic verification in the update mechanism itself.

Attack Chain

1. Attacker gains unauthorized write access to AOMEI update server infrastructure.
2. Attacker replaces 'down_html.ini' and 'Notifycfg.ini' with malicious variants for a 5-10 minute window.
3. Target AOMEI Backupper process checks for updates over HTTPS and downloads the attacker-specified malicious package.
4. 'Notifycfg.ini' triggers the execution of the downloaded malicious package with the privileges of the AOMEI service.
5. The 'CROSSROAD' downloader executes, creates a scheduled task for persistence, and removes itself from the disk.
6. The scheduled task invokes a signed, legitimate Radmin binary paired with a malicious DLL that loads the 'SHINYROAD' backdoor.
7. 'SHINYROAD' establishes C2 communication; attackers may subsequently push the Adaptix framework disguised as Nitro PDF software.
8. In some instances, the attacker triggers an invisible WebDAV pop-up to force NTLMv2 authentication credential leakage.

Impact

The campaign successfully compromised systems across 11 countries, including Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. Successfully infected machines grant the actor remote shell access, persistence, and potential credential harvesting capabilities. As the implant runs with the privileges of the AOMEI service, it can facilitate system-wide software installation and code execution, representing a significant compromise of the host environment.

Recommendation

• Hunt for unauthorized scheduled tasks including 'RadminComponentRuntime' or 'NitroRuntime' created between May and July 2026.
• Block outbound connections to the malicious infrastructure (storage-data[.]com, promotion.storage-data[.]com, aomei.storage-data[.]com) and the associated IP addresses (8.210.84.56, 8.218.65.184, 47.239.60.117).
• Block outbound SMB (TCP 445) and WebDAV traffic from internal hosts to unauthorized external destinations to prevent NTLM credential relay.
• Inspect file system logs for unsigned executables or suspicious binaries originating from AOMEI's local application data folders.
• Deploy Sigma rules to detect the creation of unusual scheduled tasks from AOMEI-related processes.