# Hackers Use Brief Server Tampering to Infect AOMEI Software Users Globally

> Threat actors tracked as UNC7017 hijacked AOMEI Technology update servers between April and July 2026, secretly distributing malware through novel, five-to-ten-minute tampering windows affecting users in at least 11 countries.

By PrimaryBrief newsroom · Published 2026-10-19T19:56:14.168818Z
Canonical: https://primarybrief.com/article/hackers-use-brief-server-tampering-to-infect-aomei-software-users-globally-d65a4ea2

Threat actors tracked as UNC7017 repeatedly hijacked update servers belonging to Hong Kong-based AOMEI Technology between April and July 2026, secretly distributing malware through brief, five-to-ten-minute tampering windows [1][2][7]. This novel “short-burst” technique affected AOMEI Backupper and AnyViewer users in at least 11 countries [6][7].

The unusual brevity of these attacks allowed the perpetrators to evade standard detection methods, leaving infected systems vulnerable even after AOMEI's server-side fixes were implemented [2][3][4][7][11]. Organizations across various sectors remain at risk of persistent compromise, highlighting a new challenge in supply chain security [6][7][11].

## What the records show

Between April and July 2026, threat actors modified two plain-text configuration files, `down_html.ini` and `Notifycfg.ini`, on AOMEI's update servers [1][2][3][4][5][6][7][8][11]. These files control update packages, checksums, and in-app notifications for AOMEI Backupper and AnyViewer software [2][3][4][5][6][11]. The attackers temporarily altered these files for short periods, typically five to ten minutes, before restoring them to their legitimate state [1][2][3][4][5][7][8][11]. This “ephemeral supply chain tampering” exploited a lack of cryptographic verification for the configuration files and their embedded checksums [2][3][4][5][6][8][11].

When an AOMEI software client checked for updates during a tampering window, it downloaded a malicious package [2][3][4][5][6][11]. The `Notifycfg.ini` file then directed the application's notification process to execute the downloaded malware without user interaction [2][3][4][5][6][11]. The malware payload included `CROSSROAD`, a downloader, and `SHINYROAD`, a backdoor [2][4][5][7][8][11]. In some cases, a legitimate Radmin remote administration tool was used to sideload an attacker-compiled DLL containing an encrypted PocketPy implant [2][8][11]. The open-source Adaptix C2 tool was also observed on some machines [2][11].

## The timeline

ManageEngine's Threat Analysis Lab (METAL), part of Zoho Corporation, first detected suspicious activity on May 28, 2026 [6][8][9][10]. On this date, METAL recorded AOMEI Backupper installing Radmin on two customer endpoints in different countries [6][8]. This specific tampering window lasted approximately 10 minutes, from 05:40 to 05:50 UTC [2][8][11]. Subsequent investigations confirmed additional tampering windows, including six minutes on July 16, 2026 (08:33–08:39 UTC) and five minutes on July 20, 2026 (10:35–10:40 UTC) [2][4][11]. Google Threat Intelligence Group (GTIG) believes other undetected windows may have occurred between April and July 2026 [2][4][7]. The findings were disclosed in mid-October 2026, following a joint investigation by GTIG, Mandiant, and METAL [1][2][4][5][6][7][8]. Mandiant researcher Tyler McLellan detailed the wider UNC7017 campaign [6][7].

## What changed and for whom

The campaign's victims were opportunistic, affecting organizations in sectors such as IT services, telecommunications, and higher education [6][7]. Compromises were identified across 11 countries: the United States, Australia, India, Brazil, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, and Türkiye [6][7]. The actual reach of compromised systems could be broader than directly identified [6][7].

## What the subject has said publicly

AOMEI has reported fixing its servers to address the vulnerabilities exploited by UNC7017 [3][5][6]. This action was taken to prevent further malicious update distributions [3][5][6]. However, this server-side remediation does not remove the malware from machines that were infected during the tampering windows [3][5]. Systems compromised during the attack remain at risk [3][5].

## What we could not confirm

The exact number of unique organizations or individual systems compromised by the attack is not confirmed [6][7].
The specific identity or affiliation of the threat actors tracked as UNC7017 is not confirmed [2].
The full extent of the data exfiltrated or actions taken by the attackers on compromised systems is not detailed in the available records [2][8].

## Evidence cited
1. Hackers hijack AOMEI update servers to secretly spread malware (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/
2. layer7data.com (layer7data.com) — https://layer7data.com/
3. atlabyte.com (atlabyte.com) — https://atlabyte.com/
4. techinformed.com (techinformed.com) — https://techinformed.com/
5. Hackers hijack AOMEI update servers to secretly spread malware (www.thehackernews.com) — https://thehackernews.com/
6. Hackers hijack AOMEI update servers to secretly spread malware (cyberinsider.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEtlip5rm_6TCWo5z3FWj1iqzDNpUvhWBhGDImbjH7DDw0hKl_dpNYboBDt_nC-luly5oSDAE9_Mk4uuLd19gyf5N_5HDWDDgT5Ie2gpF8nEMbgiQwh_afIhclpxmx0wh8Tt1BtomidAgMP6DUzImOAlWMRX54gtQZ7KtbH2bPM2gzCLabb4FVS-kf4fjuASttwC8RJzFlo6kU-hUc=
7. Google Threat Intelligence, Mandiant Uncover Novel Supply Chain Attack Targeting AOMEI Technology (google.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHRWpgD6A1ck8_aCAoTs7Z8U7x-5OT-MmljP-9KGIND3wumkcOgn0P-oIBWEeFs6YOF1WU-Hy8Vp31FBfDGn2ER5aMLHQECQnWaAXf452qZ5jVPMg3H-O9oK11QIAB99moELJYAkElQeLkblkebVKwDtPhat3V7AMEAweP4dqBzO9q0ReCrtNT2jkKQ1y-BY0madhcdzBOLoRrBiMri8jrL1IM=
8. AOMEI Backupper: "Short-burst" supply chain attack (UNC7017) | ManageEngine Blog (manageengine.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGvyS0XoV1bb-IGDUz7N7OF3ZD8Y39_EXHrEo1czH2KzhiHUTlnZU6rdKz6v8Aw8KzWgZ6AnOQo4L2kqZzcvw5Tu_7_KZd-YpKdVk55-WnbKvDv0ca3csxFNXKjvFI08znj9WJDn-FFY5H7-Yy4w0Z_3dLqNZ2BirKe82SGOLKBhOtQ1WEWZtB5fiFP43Ze9S3A==
9. google.com (manageengine.com) — https://manageengine.com/
10. What is ManageEngine? | Zoho.com (zoho.com) — https://zoho.com/
11. google.com (netmanageit.com) — https://netmanageit.com/