UNC7017 Faked Checksums to Bypass AOMEI Integrity Checks and Infect Global Victims

Attackers known as UNC7017 gained persistent access to victim networks by hijacking legitimate software updates from AOMEI Technology. By briefly altering server configurations, the group distributed hidden backdoors to systems that automatically polled for upgrades. This supply chain compromise allowed the adversaries to bypass conventional security checks, as the malicious content arrived through a trusted vendor channel.

In plain English

The hackers did not change the actual software programs released by AOMEI. Instead, they modified two configuration files that tell the application where to download updates and how to verify them. One file specified the download location and a digital fingerprint for the file. The other directed the notification system to trigger local execution of the downloaded content.

The background

ManageEngine’s Threat Analysis Lab first detected suspicious activity through endpoint telemetry on May 28, 2026. This early warning helped investigators reconstruct infections that later server checks could not reproduce. The attackers restored legitimate content quickly, leaving the infrastructure appearing clean to conventional security scans. Continuous monitoring was required to capture the malicious content during its brief delivery windows.

What changes now

Google Threat Intelligence Group researchers confirmed the campaign delivered the CROSSROAD downloader and SHINYROAD backdoor. The malicious archive, named upgrade-now.zip, contained upgrade-now.exe. Exposure was opportunistic, meaning only systems checking for updates during active tampering windows received the malware. Identified victims likely represent only a portion of the total reach, as many infections may have gone undetected after the servers were restored.

What made it possible

This incident highlights the risk of trusting client-side configuration files for security decisions. When applications rely on remote servers to define both the source of an update and its integrity checksum, attackers who compromise those servers can bypass validation. The weakness lies in the lack of independent authentication for these settings. This technique serves the initial compromise stage of an intrusion, allowing adversaries to use trusted workflows to deploy malware without exploiting software vulnerabilities.

Background: Supply chain attacks

Small businesses face supply chain attacks because attackers target weaker vendors to reach you. Protect your network by enforcing least privilege, verifying software signatures, and demanding strict access logs from your IT provider. Isolate critical data and assume third-party tools can be compromised at any time.

Read the full guide: Supply Chain Attack Risks and Protection for Small Business

What to do and how to stay safe: AOMEI

• Review endpoint telemetry logs for unexpected execution of downloaders or backdoors during known update windows.
• Verify that software clients authenticate configuration sources independently of the content they reference.
• Monitor for connections to known malicious domains associated with the CROSSROAD and SHINYROAD infrastructure.
• Isolate systems that downloaded updates from AOMEI during the identified tampering periods for forensic analysis.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which organizations were affected by this AOMEI supply chain attack?

Victims included IT services, telecommunications and higher education organizations across eleven countries, including India, Australia, Brazil and the United States.

How long did the attackers compromise the AOMEI servers?

Confirmed exposure windows lasted ten minutes on May 28, six minutes on July 16 and five minutes on July 20.

What malware did the attackers distribute?

The campaign delivered the CROSSROAD downloader and the SHINYROAD backdoor through trusted software workflows.