AOMEI Backupper update channel delivered a backdoor
AOMEI Backupper distributed an attacker-controlled backdoor through its normal update process during several short periods between May and July 2026, according to Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine's Threat Analysis Lab. Windows computers that contacted the update servers during those periods could download and execute the malicious package without additional action from the user.
AOMEI Backupper is backup and disk-cloning software that runs background services and regularly contacts AOMEI's servers over HTTPS, an encrypted connection used to transfer web traffic. Its update process relies on two text files. The down_html.ini file identifies the package and contains its checksum, a value used to check whether a downloaded file matches an expected copy. Notifycfg.ini controls promotional notifications and tells the software what to display or run.
The program did not cryptographically verify either file. Its checksum was stored in the same unsigned file that identified the download, allowing an attacker able to alter both files on the server to substitute a package and provide a matching checksum. ManageEngine said no software vulnerability was exploited. The malicious package was fetched through the application's intended update steps, placed in Backupper's own folder and launched with the privileges of the AOMEI process. On the systems examined by the lab, those privileges were sufficient for system-wide installation, although the available access depended on how the service was running.
GTIG and Mandiant confirmed three periods of server tampering: May 28 from 05:40 to 05:50 UTC, July 16 from 08:33 to 08:39 UTC, and July 20 from 10:35 to 10:40 UTC. They believe other windows may have occurred. Computers checking immediately before or after those minutes received genuine files, making later investigation difficult. GTIG characterised the targeting as opportunistic because infection depended on when each installation happened to contact the server.
GTIG's telemetry identified affected organisations in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It did not provide a total and said the true number was probably higher. The group behind the activity is tracked by GTIG as UNC7017, but no country or previously known actor was named. GTIG said this was the first software supply chain compromise it had encountered that relied on such short Windows update windows to avoid point-in-time checks and automated file scanning.
The detections concern Backupper, although GTIG said AOMEI's AnyViewer remote-desktop software uses the same update flow. Neither research report identifies all affected Backupper versions. ManageEngine examined version 8.3.0. The Hacker News reviewed AOMEI's changelog on October 16 and found no listed change to update verification through version 8.5.0, released October 9. Neither report identifies a Backupper release that closes the verification weakness.
On compromised computers, a downloader named CROSSROAD unpacked files into a local Radmin folder, created a scheduled task that ran every three hours and removed itself. The files included a legitimate signed copy of the Radmin remote-administration program. ManageEngine found no active listener, configuration or newly created account for Radmin. Instead, the scheduled task started the signed program, which loaded a nearby attacker-created Dynamic Link Library (DLL), a file containing code another Windows program can run. That code loaded SHINYROAD, an implant providing a remote command shell and the ability to retrieve and execute more code.
SHINYROAD communicated with one fixed address and had no backup destination, so blocking that address could interrupt the attacker's control. CROSSROAD also checked the computer's location and stopped in China. ManageEngine said it stopped when certain security agents were present. On systems passing those checks, GTIG later observed the open-source Adaptix command-and-control (C2) framework, software used to send instructions to compromised computers, delivered while disguised as Nitro PDF software.
The July 20 incident also used a method that did not require a program to execute. The altered notification configuration opened an invisible one-pixel window that accessed an attacker-hosted file through WebDAV, a method for treating remote files like local ones. Windows could then transmit the signed-in user's NetNTLMv2 authentication response to the attacker's address. That response could potentially be reused or subjected to offline password cracking. Consequently, a computer that blocked the backdoor itself could still have disclosed authentication material without showing anything to the user.
ManageEngine said its endpoint software first detected the activity on May 28, when Backupper installed Radmin at two unrelated customers in different countries. A customer reported the event on June 7, and the lab notified AOMEI that day. AOMEI initially attributed the altered content to interception while it travelled across the network, but ManageEngine said the evidence did not support that explanation. Both computers had used HTTPS to fetch the files from AOMEI's servers through the normal update process, despite being on different networks and in different countries. The lab later observed a July window while it was active and confirmed that altered files were being served from AOMEI's side.
Mandiant notified AOMEI and supplied indicators on July 17. AOMEI told Mandiant on July 29 that it had taken corrective action to secure the servers. ManageEngine had not independently confirmed containment when its report was published. The method used to gain access to the servers remains unknown, and server-side remediation does not remove malware already installed on Windows systems.
GTIG and ManageEngine recommend examining AOMEI installations across the full April-to-July period. Investigators should look for scheduled tasks named RadminComponentRuntime or NitroRuntime, an unsigned upgrade-now.exe carrying AOMEI publisher details, programs launched from Backupper's html pop-up folder, and attacker files under the local Radmin application-data folder. Cached application files and network records from the precise alert time are especially important because the downloader restored the local update file after persistence was established.
The published network indicators are storage-data[.]com, promotion.storage-data[.]com, aomei.storage-data[.]com, 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117. The reports also recommend blocking outbound Server Message Block (SMB) traffic on TCP port 445 and external WebDAV connections to limit the credential-leak method. GTIG published YARA detection rules, while ManageEngine supplied Sigma rules. The Hacker News said it had not tested either set.