Attackers Used Brief AOMEI Backupper Update Windows to Deploy Backdoors

Attackers repeatedly altered files delivered through AOMEI Backupper’s legitimate update infrastructure, creating short windows in which Windows systems checking for updates downloaded and executed a backdoor.

Google Threat Intelligence Group (GTIG) and Mandiant confirmed three tampering periods lasting between five and ten minutes, according to The Hacker News’ account of the researchers’ findings. Organizations were identified across 11 countries, but GTIG did not provide a total number of affected systems or organizations.

AOMEI told Mandiant on 29 July 2026 that it had taken corrective action to secure its servers. That server-side work does not remove malware from endpoints already compromised, and ManageEngine’s Threat Analysis Lab had not confirmed containment as of publication.

Three confirmed tampering windows

GTIG and Mandiant identified the following periods in which malicious content was delivered:

Only Backupper installations that contacted the update service during one of those windows received the altered files. Systems checking immediately before or afterward were served legitimate content. The researchers assessed that other windows probably occurred without being observed.

GTIG described the targeting as opportunistic. Its telemetry identified affected organizations in IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. These 11 countries represent locations where GTIG found affected organizations, not a count of victims or compromised machines.

The threat cluster is tracked as UNC7017. GTIG did not associate it with a country or previously named actor.

Unsigned update instructions enabled the attack

The operation depended on changes to two files fetched by Backupper:

• down_html.ini, which specifies the update package and its checksum;
• Notifycfg.ini, which controls the software’s pop-up service and the content it runs.

Backupper does not cryptographically authenticate either file. The package checksum is stored in the same unsigned configuration file that tells the application what to download, allowing an attacker able to modify that file to substitute both the package and the value used to check it.

ManageEngine assessed that the delivery method did not require exploitation of a software vulnerability. Beyond installing and running Backupper, no additional user interaction was required. How UNC7017 obtained the ability to alter content on AOMEI’s infrastructure has not been established.

ManageEngine examined Backupper 8.3.0, but the reports did not define the complete range of affected versions. GTIG said AOMEI’s AnyViewer remote-desktop product uses the same update process, although its detections concerned Backupper.

On 16 October 2026, The Hacker News checked AOMEI’s changelog and found that the current release was 8.5.0, issued on 9 October 2026. The changelog did not describe a change to update verification, and no release has been identified as closing that design gap.

CROSSROAD installed a persistent execution chain

The first-stage downloader, named CROSSROAD, unpacked a bundle into a local Radmin directory and created the scheduled task RadminComponentRuntime, configured to execute every three hours. CROSSROAD then removed itself from disk.

The malware checked the machine’s location and stopped when it detected a system in China. ManageEngine also reported that it terminated when particular security products were present.

The staged bundle included a genuine, digitally signed copy of Radmin, a commercial remote-administration application. On systems examined by ManageEngine, Radmin had been placed on disk but was not configured as an active remote-access service: the lab found no listener, configuration or newly created account.

Instead, UNC7017 used the signed Radmin executable to load a malicious DLL from the same directory. That DLL launched SHINYROAD, an implant providing a remote shell and the ability to retrieve and run further code. SHINYROAD contacted one hard-coded address and had no backup command-and-control destination, meaning that blocking the address disrupted attacker control, according to the report.

On some systems, GTIG observed the open-source Adaptix C2 framework deployed through SHINYROAD and presented as Nitro PDF software. Its associated scheduled task was named NitroRuntime.

The payload inherited the privileges of the AOMEI process that started it. On the machines ManageEngine examined, those privileges permitted system-wide software installation, although the level of access depended on how the AOMEI service was running.

A separate modification could expose Windows credentials

During the 20 July 2026 window, GTIG found that Notifycfg.ini had also been modified to display an invisible one-pixel pop-up. The pop-up referenced a file hosted on attacker-controlled infrastructure through WebDAV.

Rendering that content could cause Windows to send the logged-in user’s NetNTLMv2 response to the attacker. Because this technique does not depend on running the backdoor executable, blocking the malware chain alone would not necessarily have prevented the credential exposure.

The recommended network controls include blocking external WebDAV and outbound SMB traffic on TCP port 445, alongside the identified attacker infrastructure.

Detection began weeks before AOMEI reported corrective action

ManageEngine’s endpoint software first recorded Backupper installing Radmin on two unrelated customer systems in different countries on 28 May 2026. A customer raised the activity on 7 June 2026, and ManageEngine notified AOMEI that day.

AOMEI initially said the content had been intercepted and changed in transit, according to the report. ManageEngine disputed that explanation: both systems had used HTTPS to retrieve the files directly from AOMEI servers, from separate countries and networks, through the normal update process.

In mid-July 2026, ManageEngine captured another short tampering window as it happened. The lab said this showed that altered content was being served from AOMEI’s side.

Mandiant notified AOMEI and supplied indicators on 17 July 2026. AOMEI told Mandiant on 29 July 2026 that it had secured its servers. GTIG, Mandiant and ManageEngine disclosed the campaign during the week of the source report.

Compromised endpoints may no longer show the malicious update

Checking AOMEI’s current download page is not sufficient to clear an earlier alert. The malicious files were available only for minutes, while legitimate files were served at other times. CROSSROAD also restored the local update file to its genuine contents after establishing the scheduled task.

GTIG and ManageEngine recommend preserving files cached in Backupper’s own directories, reviewing network records from the exact time an alert occurred, and hunting across the full April–July period.

Endpoint indicators highlighted by the researchers include:

• scheduled tasks named RadminComponentRuntime or NitroRuntime;
• an unsigned upgrade-now.exe containing AOMEI publisher details;
• any executable launched from Backupper’s HTML pop-up directory;
• attacker-controlled files under the local Radmin application-data folder.

Reported network indicators include:

• storage-data[.]com
• promotion.storage-data[.]com
• aomei.storage-data[.]com
• 8.210.84[.]56
• 8.218.65[.]184
• 47.239.60[.]117

GTIG published YARA rules, while ManageEngine released Sigma rules for related detection. Organizations that find these artifacts should treat the endpoint separately from AOMEI’s server remediation: corrective action on the update infrastructure does not disable scheduled tasks, remove implants or invalidate credentials already exposed.