Google Threat Intelligence Group and Mandiant published an investigation on 15 October, written by Tyler McLellan, into a software supply chain compromise at AOMEI Technology, whose Backupper and AnyViewer products are the ones most people know it for.

The attacker, tracked as UNC7017, never left a malicious file sitting on AOMEI's update servers. They edited the update configuration, left it changed for a few minutes, and then put the authentic contents back.

Ten minutes, six minutes, five minutes

Mandiant confirmed 3 windows: 28 May from 05:40 to 05:50 UTC, 16 July from 08:33 to 08:39, and 20 July from 10:35 to 10:40. A client that polled for updates inside one of those windows was handed malicious instructions. A client that polled a minute either side got a clean file.

Mandiant says additional windows probably occurred that it did not see, and calls this the first software supply chain compromise it has seen using windows this short.

The mechanism needed no vulnerability at all. Two files on the update origin were edited: one that carries the download URL, version and hash, and one that carries the popup and notification commands. Everything after that is the client's normal update workflow doing its job.

Why this breaks the way you investigate

The usual response to a supply chain alert is to go and look at the vendor's URL. Do that here and it returns the legitimate file, because it was legitimate again within minutes. Mandiant is blunt about the consequence: hours-later checks show only benign infrastructure, which hampers root cause and finding patient zero.

It gets worse on the endpoint. The downloader, which Mandiant calls CROSSROAD, deletes itself after running, renaming its data stream to an unprintable name first. Before going it rewrites the local config back to AOMEI's own URL and resets the version number, so the cached copy on the machine no longer shows what was served to it.

So the server looks clean, the local config looks clean, and the file that did the work is gone. We ran the Talos quarterly two days ago, where the leading weakness across every engagement was that nobody could see what had happened. This is what that looks like when it is engineered on purpose rather than left to chance.

What did survive

Enough, if you kept it. Mandiant lists scheduled tasks named RadminComponentRuntime and NitroRuntime, files under the local Radmin and Nitro Pro application data directories, temporary files, registry blobs, and the endpoint-cached config copies the downloader missed. Then EDR telemetry, proxy and firewall logs, and DNS records.

It was EDR telemetry that caught this at all. ManageEngine's threat analysis lab flagged the activity in late May. Mandiant notified AOMEI on 17 July, and AOMEI reported corrective action on 29 July.

What was actually delivered

A Radmin-based backdoor Mandiant calls SHINYROAD, loaded by hijacking the DLL search order of a legitimately signed AOMEI executable, with an embedded Python interpreter inside it. Earlier variants used raw TCP on port 41397. From mid-July the actor added an Adaptix C2 agent, sideloaded through a Nitro-branded binary, beaconing every 2 minutes to port 6800.

On 16 July the notification config was padded with over 35,000 lines of dummy sections, forcing an update regardless of the version a client was on.

On 20 July a 1-pixel popup pointed at a file path on a remote host, which is a quiet way to collect authentication hashes from anyone whose client rendered it.

Staging moved around: Alibaba Cloud storage in April and May, a registered domain in early July, and a public Google Cloud Storage bucket on 20 July.

Who was hit

The sectors were IT services, telecommunications and higher education, across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. Mandiant describes the victimology as opportunistic and says it is likely broader than what it identified, which follows from the method: anything polling during a window was a candidate.

What to do

  • Hunt backwards through April to July 2026. A fix on the vendor's server does nothing for a machine that already ran the payload.
  • Check scheduled tasks for RadminComponentRuntime and NitroRuntime, and look under the local Radmin and Nitro Pro directories.
  • Stop treating a clean vendor URL as a negative result. Preserve the endpoint's cached config files instead, and correlate proxy and firewall logs to the second of the alert.
  • Alert on an unsigned DLL loading next to a signed vendor binary. The signature was real here; the DLL beside it was not.
  • Trace what spawned an updater rather than assuming a Nitro-branded alert was a user downloading something.
  • Mandiant published YARA rules for the three components. Take them.

What is not established

  • How UNC7017 reached AOMEI's origin servers. The report does not describe an access vector.
  • How many tampering windows there were. Three were confirmed and Mandiant expects there were more.
  • How many organisations were affected. The identified set is explicitly not the complete one.
  • Who UNC7017 is. Mandiant tracks it as a cluster and ties it to no named group.
  • What AOMEI found. The report notes corrective action and nothing about the vendor's own conclusions.
  • Whether this method is being used elsewhere. It is the first case Mandiant has seen, which is not the same as the only one.