Threat actors tracked as UNC7017 repeatedly hijacked update servers belonging to Hong Kong-based AOMEI Technology between April and July 2026, secretly distributing malware through brief, five-to-ten-minute tampering windows. This novel “short-burst” technique affected AOMEI Backupper and AnyViewer users in at least 11 countries.

The unusual brevity of these attacks allowed the perpetrators to evade standard detection methods, leaving infected systems vulnerable even after AOMEI's server-side fixes were implemented. Organizations across various sectors remain at risk of persistent compromise, highlighting a new challenge in supply chain security.

What the records show

Between April and July 2026, threat actors modified two plain-text configuration files, down_html.ini and Notifycfg.ini, on AOMEI's update servers. These files control update packages, checksums, and in-app notifications for AOMEI Backupper and AnyViewer software. The attackers temporarily altered these files for short periods, typically five to ten minutes, before restoring them to their legitimate state. This “ephemeral supply chain tampering” exploited a lack of cryptographic verification for the configuration files and their embedded checksums.

When an AOMEI software client checked for updates during a tampering window, it downloaded a malicious package. The Notifycfg.ini file then directed the application's notification process to execute the downloaded malware without user interaction. The malware payload included CROSSROAD, a downloader, and SHINYROAD, a backdoor. In some cases, a legitimate Radmin remote administration tool was used to sideload an attacker-compiled DLL containing an encrypted PocketPy implant. The open-source Adaptix C2 tool was also observed on some machines.

The timeline

ManageEngine's Threat Analysis Lab (METAL), part of Zoho Corporation, first detected suspicious activity on May 28, 2026. On this date, METAL recorded AOMEI Backupper installing Radmin on two customer endpoints in different countries. This specific tampering window lasted approximately 10 minutes, from 05:40 to 05:50 UTC. Subsequent investigations confirmed additional tampering windows, including six minutes on July 16, 2026 (08:33–08:39 UTC) and five minutes on July 20, 2026 (10:35–10:40 UTC). Google Threat Intelligence Group (GTIG) believes other undetected windows may have occurred between April and July 2026. The findings were disclosed in mid-October 2026, following a joint investigation by GTIG, Mandiant, and METAL. Mandiant researcher Tyler McLellan detailed the wider UNC7017 campaign.

What changed and for whom

The campaign's victims were opportunistic, affecting organizations in sectors such as IT services, telecommunications, and higher education. Compromises were identified across 11 countries: the United States, Australia, India, Brazil, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, and Türkiye. The actual reach of compromised systems could be broader than directly identified.

What the subject has said publicly

AOMEI has reported fixing its servers to address the vulnerabilities exploited by UNC7017. This action was taken to prevent further malicious update distributions. However, this server-side remediation does not remove the malware from machines that were infected during the tampering windows. Systems compromised during the attack remain at risk.

What we could not confirm

The exact number of unique organizations or individual systems compromised by the attack is not confirmed.
The specific identity or affiliation of the threat actors tracked as UNC7017 is not confirmed.
The full extent of the data exfiltrated or actions taken by the attackers on compromised systems is not detailed in the available records.