AOMEI update mechanism abused in brief server-tampering campaign
Researchers found a supply-chain attack in which AOMEI Backupper update and promotional configuration files were altered on vendor servers for brief windows and then restored. During confirmed intervals in May and July 2026, affected installations fetched and ran a malicious package from attacker-controlled locations, leading to a backdoor. ManageEngine detected the activity after Radmin was installed on customer systems and alerted AOMEI.
Three confirmed intervals—May 28, July 16, and July 20, 2026—saw altered configuration files served for only minutes before the originals returned. Those files guide update and promotional pop-up behavior for AOMEI Backupper 8.3.0 and later.
On May 28, ManageEngine’s endpoint product recorded Radmin installations on two unrelated customer machines in separate countries. A customer flagged it June 7, and METAL contacted AOMEI that day. Google’s GTIG and Mandiant later caught another malicious serving period on July 20. Google labels the actor UNC7017; confirmed victims include IT services, telecommunications, and higher education.
The campaign may affect organizations using AOMEI Backupper for backups, particularly IT services, telecom, and higher education. Short-lived server changes could expose endpoints to remote administration and backdoors, while the WebDAV step may leak password hashes even when malicious code was blocked. Because altered content was restored quickly, some victims may remain unaware; incident response and credential resets could be warranted.