Attackers repeatedly tampered with files fetched by AOMEI Backupper from the vendor's update servers between May and July 2026, allowing them to distribute a backdoor. This sophisticated supply chain attack did not exploit any software vulnerabilities but instead relied on briefly replacing legitimate update files with malicious ones. The compromise affected organizations across 11 countries, including those in IT services, telecommunications, and higher education, based on information published by The Hacker News.
The attackers manipulated two configuration files, down_html.ini and Notifycfg.ini, on AOMEI's servers during short, five- to 10-minute windows. These files, which were not cryptographically verified by the AOMEI Backupper software, dictated which update packages to download and what notifications to display. During these brief periods, any AOMEI Backupper instance checking for updates would download and execute a backdoor. The campaign, tracked as UNC7017, deployed a downloader called CROSSROAD, which installed a backdoor and a remote administration tool. A subsequent exploit leveraged a WebDAV vulnerability to steal user authentication tokens without running any executable code. While AOMEI has reportedly secured its servers, affected machines remain compromised, and organizations are urged to hunt for specific indicators of compromise across their systems and networks.
Source: The Hacker News
