# How Cyber Attackers Used Short-Burst Supply Chain Attacks to Infect Millions Through Backup Software
A popular Windows backup and disk cloning tool was exploited by hackers in a series of quick, sneaky attacks that lasted only minutes at a time. Security researchers from Google Cloud, Mandiant, and ManageEngine have uncovered a troubling campaign that targeted users of AOMEI Backupper, a software suite with over 186 million users worldwide.
## What Happened?
Between April and July, hackers managed to tamper with AOMEI Backupper’s update servers on multiple occasions. Each time they gained access, they used it for a very brief window — between five and ten minutes — before reverting everything back to normal. This made the attacks extremely difficult to detect.
During those short windows, the attackers redirected the software’s update process to deliver malicious files to anyone who happened to download an update during that time. Because the attacks were so brief and scattered, they affected systems globally without targeting any specific group of users.
## Who Was Affected?
The attacks reached users in countries including Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. Organizations in higher education, IT services, and telecommunications were among those compromised.
## How Did the Attackers Pull It Off?
The hackers, tracked under the name UNC7017, found a clever way to abuse the software’s update process. They exploited two configuration paths within AOMEI’s promotional content delivery system. One path controlled what content appeared on screen, and the other controlled what could actually be executed. Neither file was protected with cryptographic authentication, making it possible for the attackers to swap out legitimate content with malicious versions.
Once inside the system, the attackers delivered several types of malware in stages. First came a dropper tool called CrossRoad, which prepared the system and set up persistence. This was followed by ShinyRoad, a modular backdoor that allowed the attackers to maintain long-term access. Later, the Adaptix command-and-control framework was deployed to manage compromised machines remotely.
In one particularly sophisticated move, the attackers also replaced a legitimate banner on the software interface with a tiny one-pixel window. This forced the AOMEI client to connect to a remote server through WebDAV, which silently sent authentication credentials to the attackers.
## Why This Matters
This campaign represents a shift in how supply chain attacks are being carried out. Traditionally, attackers tried to insert malicious code into software source code or tamper with development pipelines — methods that require significant effort and technical access. UNC7017 instead chose to tamper briefly with server configuration files, a method that requires less effort and leaves a smaller footprint.
## What Did the Software Vendor Do?
ManageEngine’s threat analysts first flagged the suspicious activity in early June. Despite being notified, the software vendor initially dismissed the report, suggesting the content might have been altered during transit. It was not until mid-July that the vendor acknowledged the problem and began taking corrective action.
## FAQ
**What is AOMEI Backupper?**
AOMEI Backupper is a Windows-based backup, synchronization, and disk cloning tool available in both free and paid versions for personal and business use.
**Who discovered these attacks?**
Security researchers from Google Cloud’s Threat Intelligence Group, Mandiant, and ManageEngine Threat Analysis Lab collaborated to investigate and report the campaign.
**How long did each attack window last?**
Each tampering window lasted only five to ten minutes before the attackers reverted the servers to their legitimate state.
**What types of malware were delivered?**
The attackers delivered CrossRoad, ShinyRoad, Adaptix, and a modified version of Radmin Server remote administration tool, among other payloads.
**Were specific organizations targeted?**
No. The attacks appeared opportunistic, hitting any system that downloaded the tampered packages during the brief attack windows.
**Was the software vendor responsive?**
The vendor initially dismissed the report from ManageEngine in June but took corrective action after being notified again by Google Cloud in July.
## Conclusion
This campaign serves as an important reminder that supply chain attacks are evolving. Even widely used software with millions of users can be compromised through brief and subtle server tampering. For users, staying vigilant about software updates and using security tools that monitor for unexpected network connections can help reduce risk. For software vendors, prompt response to security researcher reports is critical in limiting the damage of these kinds of attacks.
Thank you for reading
