Attackers changed files on the update servers of AOMEI Technology, a backup and remote-access software vendor, to deliver malware to customers checking for updates. The changes lasted as little as five minutes before the original files were restored.
Google Threat Intelligence Group (GTIG) and Mandiant, Google’s incident-response firm, described the attack in their report, “Investigating Ephemeral Supply Chain Tampering.” They traced the activity from April to July 2026 and said they had not previously encountered a software supply chain compromise carried out in such short windows.
The investigation drew on findings from ManageEngine’s Threat Analysis Lab, whose security software first detected suspicious activity involving AOMEI Backupper in late May.
AOMEI Backupper, a backup and recovery application, and AnyViewer, a remote desktop tool, periodically check the company’s servers for software updates and in-app notifications. The attackers, tracked as UNC7017, changed two configuration files. One directed the application to download a malicious package containing CROSSROAD, a downloader that retrieved additional malware. The other instructed the application’s normal notification process to execute the downloaded malware.
The attack used existing software functions rather than exploiting a vulnerability in the application. The configuration files lacked cryptographic authentication, allowing the attackers to change both the download address and the checksum used to verify the downloaded package.
Researchers confirmed three tampering windows: 10 minutes on May 28, six minutes on July 16 and five minutes on July 20. Devices checking during those periods could receive malicious instructions. Checks made before or after returned legitimate files. Google said other windows may have gone undetected.
Why later checks could miss the attack
The brief changes made the original infection route difficult to reconstruct, according to the firms.
Mandiant said security analysts sometimes check a vendor’s live download URL after an alert to see whether it is malicious. In this campaign, however, the files would already have been restored. CROSSROAD also restored local update settings to their legitimate values, making the initial compromise harder to trace. It established a scheduled task to launch SHINYROAD, a backdoor that maintained access to infected devices.
Mandiant advised investigators to preserve configuration files cached on affected devices and compare them with network logs from the time an alert appeared. It also recommended examining suspicious processes launched by software updaters.
A hidden popup could expose credentials
On July 20, the attackers also changed an in-app promotional banner into an invisible one-pixel window. The window requested a remote file over WebDAV, a network protocol, which Google said could cause a Windows device to send authentication hashes to an attacker-controlled server without the user’s involvement.
The campaign used attacker-controlled domains and cloud storage to deliver malware. Google observed affected organizations in the U.S. and 10 other countries, across sectors including IT services, telecommunications and higher education. It said the full extent was likely broader because infections depended on whether a device checked for updates during one of the short attack windows.
ManageEngine said it first notified AOMEI on June 7. Mandiant separately notified the vendor on July 17, three days before the final confirmed tampering window. AOMEI told the researchers on July 29 that it had taken corrective action.
Mandiant recommended verifying digital signatures on downloaded software, cryptographically signing remote configuration files and restricting what in-app notifications can execute. However, the researchers cautioned that fixing AOMEI’s servers would not remove malware already installed on customers’ devices.