Skip to content
Listening post · printoutMalware and ransomware · 4 of 37

MAL Malware and ransomware

4 of 37

UNC7017: AOMEI updates tampered with for minutes at a time

Between April and July 2026 an actor Mandiant calls UNC7017 briefly altered AOMEI's update servers so Backupper and AnyViewer pulled a backdoor, then put the clean files back.

HighContainedHigh confidenceTLP:CLEAR

Briefing updated How this is made

Scope check

  • Is your organization in one of these sectors: Technology, Telecommunications, Higher education?
Explanation level
Plain language, or the technical detail.

  1. What happened

    Simple explanation:

    AOMEI makes Backupper, a backup program, and AnyViewer, a remote access tool. For a few minutes at a time, someone changed the files on AOMEI's servers that tell the apps where to fetch updates, so any copy that checked in during that window downloaded malware instead.

    Technical explanation:

    A supply chain compromise of the ABMarket update and notification flow used by AOMEI Backupper and AnyViewer. The actor edited down_html.ini and Notifycfg.ini on AOMEI's origin servers in short bursts, so clients that polled during a window fetched a trojanized update and ran it without user interaction. No software vulnerability or CVE was involved. Mandiant does not name affected product versions.

  2. Who is behind it

    Simple explanation:

    A group Google's Mandiant team tracks as UNC7017. Mandiant has not tied it to a country or a known group.

    Technical explanation:

    UNC7017, an uncategorised cluster tracked by GTIG and Mandiant. ManageEngine's METAL team first spotted the activity in EDR telemetry in late May 2026. Mandiant gives no country nexus or motive.

  3. What they want

    Simple explanation:

    Mandiant does not say. What the group installed was a backdoor that gives remote control of the computer, which points to access rather than quick profit.

    Technical explanation:

    Not stated by Mandiant. The tooling (a persistent backdoor, Adaptix C2 and NTLM coercion) fits hands-on access to selected victims; victimology looked opportunistic.

  4. What they did

    Simple explanation:

    It swapped the update instructions for about five to ten minutes on observed days in May and July, then restored the real files. Infected machines got a downloader and a backdoor hidden behind a genuine, signed copy of the Radmin remote admin tool.

    Technical explanation:

    Directly observed tampering windows were 28 May (05:40 to 05:50 UTC), 16 July (08:33 to 08:39 UTC) and 20 July (10:35 to 10:40 UTC), within a campaign running April to July. Payloads were the CROSSROAD downloader, which sets scheduled-task persistence, and the SHINYROAD backdoor, side-loaded through a Famatech Radmin bundle (BlkScrDl.dll). In mid-July the actor also pushed Adaptix C2 (ADAPTAGENT) disguised as Nitro PDF tools, and on 20 July a hidden 1x1 pop-up pointed at a WebDAV path to coerce NetNTLMv2 authentication. Mandiant notified AOMEI on 17 July; AOMEI said on 29 July that it had taken corrective action.

  5. Who is at risk

    Simple explanation:

    Organisations whose staff ran AOMEI Backupper or AnyViewer between April and July 2026. Mandiant saw victims in IT services, telecoms and universities across at least 11 countries and expects more.

    Technical explanation:

    Windows endpoints that ran either product during April to July 2026, in any sector. Point-in-time checks of AOMEI's servers prove nothing because the real files were restored within minutes, and a server-side fix does not clean endpoints that already ran the payload.

  6. What to do

    Simple explanation:
    • Find every machine with AOMEI Backupper or AnyViewer installed and check it for the scheduled tasks and files Mandiant lists.
    • Search proxy and firewall logs from April to July 2026 for the domains and addresses in Mandiant's report.
    • Block outbound SMB and WebDAV to the internet so a hidden pop-up cannot leak Windows password hashes.
    Technical explanation:
    • Hunt retrospectively across April to July with Mandiant's YARA rules: look for the \NitroRuntime and \RadminComponentRuntime scheduled tasks, files under %LOCALAPPDATA%\Radmin\ and %LOCALAPPDATA%\Nitro Pro\, and cached configs in the AOMEI Tmphtml folder. Do not dismiss signed executables.
    • Review proxy logs for the Anyviewer-loader/1.0 user agent and for traffic to storage-data[.]com; take the full indicator set from Mandiant rather than this page.
    • Alert on unsigned child processes spawned by desktop update runners, and block outbound TCP 445 and WebDAV to external addresses.

What is not settled. Facts come from Mandiant's report, read in full. ManageEngine's companion analysis could not be opened during this refresh; search coverage of it agrees with Mandiant and adds that ManageEngine had not confirmed containment at publication. AOMEI's fix is the vendor's own statement, not independently verified, and no affected version range has been published.

AI summary of public reporting. It can be incomplete or wrong. Check the sources before you act. How this is written