Brief AOMEI update-server tampering delivered Backupper backdoors
Attackers repeatedly altered files served by AOMEI Technology’s update infrastructure for AOMEI Backupper, causing some Windows systems to download and execute a backdoor during short windows between May and July 2026. Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine’s Threat Analysis Lab confirmed three windows lasting five to 10 minutes: May 28, July 16 and July 20.
Only installations that checked for updates during those intervals were exposed. GTIG identified affected organisations in IT services, telecommunications and higher education across 11 countries, although it did not provide a total and said the actual number was likely higher. AOMEI said it had taken corrective action to secure its servers, but that action does not remove malware from already affected endpoints.
Unsigned update controls enabled the campaign
AOMEI Backupper is Windows backup and disk-cloning software. Its update process uses two files, down_html.ini and Notifycfg.ini, to identify an update package, supply its checksum, display notifications and determine what is run. The software does not cryptographically validate either configuration file, while the checksum is held in the same unsigned file that names the download.
ManageEngine said no vulnerability was exploited and no user action was required beyond having the application installed and running. By changing the two server-hosted text files briefly, the attacker could cause a polling client to retrieve a malicious package into its own folder and launch it through the notification mechanism. The process ran with the privileges of the AOMEI service; on examined systems, that was sufficient to install software system-wide, although privilege elevation depended on the service configuration.
Backdoor chain and credential exposure
GTIG calls the initial downloader CROSSROAD. It unpacked files to a local Radmin folder, created a scheduled task that ran every three hours, and then deleted itself. The bundle included a legitimate signed Radmin remote-administration executable. That executable loaded an attacker-built adjacent DLL, which loaded the SHINYROAD implant for remote shell access and command-driven code retrieval.
GTIG also observed the open-source Adaptix C2 framework deployed over SHINYROAD and disguised as Nitro PDF software. CROSSROAD checked a machine’s location and stopped in China; ManageEngine additionally reported checks for particular security agents. The researchers said SHINYROAD used one hard-coded address without a backup, meaning network blocking can interrupt the operator’s control channel.
On July 20, the altered notification file also pointed an invisible one-pixel pop-up to an attacker-controlled WebDAV location. Rendering it could prompt Windows to send the logged-in user’s NetNTLMv2 authentication response. This exposure did not require a malicious program to execute, so it could affect a system even where the backdoor payload was blocked.
Investigation must extend beyond a clean download page
GTIG tracks the activity as UNC7017 and said the short Windows update compromise could evade point-in-time triage and automated file scanning. The downloader restored the local update file to genuine contents after creating persistence, so a current vendor download page or apparently normal local file is not sufficient evidence that an endpoint was untouched.
Organisations using AOMEI software should review telemetry across April through July 2026, preserve files cached in AOMEI folders, and correlate network records with the exact alert time. Endpoint hunts should include the RadminComponentRuntime and NitroRuntime scheduled tasks, unsigned upgrade-now.exe files carrying AOMEI publisher details, and suspicious content beneath the local Radmin application-data folder. Blocking the published infrastructure and restricting outbound SMB on TCP 445 and external WebDAV are practical containment steps while affected systems are investigated.