AOMEI Backupper Update Servers Hijacked in Repeated Supply Chain Attacks
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actor UNC7017 repeatedly compromised AOMEI Backupper's update infrastructure between April and July, using brief windows of access to push malicious payloads — the CrossRoad downloader and ShinyRoad backdoor — to unsuspecting users. The short-burst nature of the campaign was deliberately designed to evade detection, exploiting the implicit trust users place in software update mechanisms. This incident illustrates how popular utilities with large install bases make high-value targets for supply chain attacks, as a single upstream compromise can cascade to millions of endpoints. Organizations that lack software integrity verification and update-pipeline monitoring have no reliable way to distinguish legitimate updates from weaponized ones.
Tactical Insight
Immediate actions
- Verify the cryptographic integrity (code signing certificates and hashes) of all software updates before deployment, especially for widely used utilities like backup tools.
- Audit systems that received AOMEI Backupper updates between April and July for signs of CrossRoad or ShinyRoad compromise.
- Isolate or quarantine affected endpoints and revoke credentials that may have been exposed to the ShinyRoad backdoor.
Long-term improvements
- Implement a software bill of materials (SBOM) practice and vet third-party software vendors for the security of their build and update pipelines.
- Enforce application allowlisting so that unexpected binaries delivered via update mechanisms cannot execute without explicit approval.
- Establish a formal third-party risk management program that includes periodic security assessments of critical software suppliers.
Detection measures
- Deploy endpoint detection and response (EDR) tooling capable of identifying anomalous child processes or network callbacks spawned from update executables.
- Monitor outbound network traffic from backup software processes for unexpected connections to unfamiliar command-and-control infrastructure.
- Centralize and correlate logs from software update events across the environment to detect brief, irregular distribution patterns characteristic of short-burst supply chain campaigns.