AOMEI Update Servers Hijacked in Short Bursts

Attackers tampered with the update servers of Windows software maker AOMEI Technology between April and July 2026, but only ever for a few minutes at a time, according to Google. Any computer that checked for an update during one of those brief windows was told to download malware. A computer that checked a few minutes earlier or later received the genuine files. Google says the servers have since been fixed, but that fix does not clean machines that were already infected.

The findings come from Google Threat Intelligence Group (GTIG) and Mandiant, set out in a Google Cloud blog post published on 15 October by Tyler McLellan. Google says it “investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026.” It attributes the activity to a group it tracks as UNC7017. “UNC” is Google’s label for an uncategorised threat cluster, and Google does not link the group to any country.

Minutes, not months

The unusual part is the timing. Google says: “Each tampering window remained active for only five to ten minutes before reverting to authentic versions. This is the first time that we have encountered a software supply chain compromise that was implemented with these very short windows.”

Google confirmed three windows:

28 May, 10 minutes (05:40-05:50 UTC);
16 July, 6 minutes (08:33-08:39 UTC);
20 July, 5 minutes (10:35-10:40 UTC).

Google says it is “probable” that more tampering happened outside its view. It notes related malware was seen in the wild from late April.

AOMEI Backupper (backup and disk cloning) and AnyViewer (remote desktop) regularly check AOMEI’s servers for update and notification settings. During each window, the attackers edited two small configuration files. One pointed the software to a malicious ZIP file on attacker-controlled servers; the other abused the notification service to run it straight away. Afterwards they restored the genuine files. Google says this makes the attack hard to spot: security teams checking the vendor’s download address after an alert would see only clean files, and could wrongly dismiss the alert as a false positive.

What was installed

The malicious package delivered what Google calls CROSSROAD, a newly tracked downloader that checks its environment and sets up a scheduled task to deploy SHINYROAD, a modular backdoor for covert remote control. Google also describes a modified version of the commercial remote-administration tool Radmin Server installed in the May wave, and the Adaptix C2 post-exploitation framework, disguised as Nitro PDF tools, from early July.

On 20 July the attackers added a second trick. They replaced a promotional banner with an invisible one-pixel pop-up window that made the computer try to open a remote file. Google says this could quietly send Windows (NTLM) authentication hashes to an attacker-controlled address, without the user seeing anything.

Who was hit

Google says affected organisations included IT services, telecoms and higher-education bodies in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. Because any system polling during a window was targeted, it says “victimology was opportunistic and likely extends more broadly than the organizations we directly identified.” Google gives no victim count.

The campaign was first detected in late May by ManageEngine Threat Analysis Lab (METAL), part of Zoho, through its endpoint telemetry. Google says Mandiant notified AOMEI on 17 July, and AOMEI responded on 29 July, “stating that corrective actions had been taken.”

Fixed servers do not mean clean machines

Google is blunt: “server-side remediation does not clean endpoints that downloaded malicious updates during earlier tampering windows.” Infected machines keep their scheduled tasks and backdoors even after the genuine files are restored. Google says organisations running AOMEI software “cannot assume they are protected solely because the vendor took corrective server-side action”. It says they should hunt across the whole April-July period using the indicators and detection rules in its post, and check the configuration files cached on each machine rather than the live website.

For software makers, Google recommends signing both update files and configuration files, restricting downloads to official domains, and keeping marketing pop-ups separate from core update code.

What this means

Anyone who ran AOMEI Backupper or AnyViewer between April and July 2026 should check their machines. AOMEI’s server fix does not remove malware that was already installed.
Attacks lasting only a few minutes can slip past checks made after the event, so security teams should rely on what is stored on each machine rather than on live URL lookups.
Google names the group only as UNC7017 and gives no country attribution or victim total.