IN SecurityWeek’s report, AOMEI Backupper, a Windows backup, sync and disk cloning tool used by about 186 million people, was compromised in a short-burst supply chain campaign between April and July 2026. Unlike traditional long-running supply chain intrusions, the attackers conducted ephemeral tampering windows of five to ten minutes, during which they redirected legitimate update packages to malicious content and altered the update flow to automatically execute downloaded payloads.
The operation targeted any systems that fetched the modified packages within those windows, which Google Cloud’s Threat Intelligence Group (GTIG) and Mandiant, with METAL, described as opportunistic rather than highly targeted.
During the tampering, the threat actor UNC7017 modified the update server’s configuration and notification mechanisms to deliver a malicious ZIP archive and to force automatic execution. The campaign relied on AOMEI’s promotional content channel, which runs background services that periodically poll AOMEI’s servers for content.
Researchers observed multiple payloads: the CrossRoad dropper, a modified version of the legitimate Radmin Server remote administration tool, and later the Adaptix C2 framework via the AdaptAgent payload. In one notable technique, a 1×1 pixel window with maximum execution priority forced the client to fetch a remote resource via WebDAV, sending NetNTLMv2 hashes to the attackers.
The attack’s reach spanned Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States, affecting higher education, IT services, and telecoms sectors. Google Cloud notes that additional tampering likely occurred beyond visible windows. AOMEI acknowledged findings in mid to late July and indicated corrective actions. The campaign exemplifies a shift toward ephemeral configuration tampering as a stealthy, low-overhead method for software supply chain abuse.