Between May and July 2026, attackers briefly manipulated the update infrastructure of AOMEI Backupper to deliver a backdoor to unwitting users. The compromise took place during three short windows—5 to 10 minutes each—when altered update files and notification configurations enabled remote access tools to install and run. The issue has since been patched on the server side, though any systems infected during those windows may still harbor the covert agent.
Supply Chain Attack Mechanism
AOMEI Backupper is a Windows utility meant for backup and disk cloning, developed by AOMEI Technology based in Hong Kong. Its update flow relies on two innocuous configuration files—down_html.ini and Notifycfg.ini—which respectively indicate what update package to download (and its supposed checksum), and what notification or promotional content to show. Crucially, neither file is cryptographically signed, and the checksum lives inside the same unsigned file that names it, leaving room for easy tampering.
Attackers didn’t exploit a software vulnerability or require any user interaction beyond simply having the software installed and running. During the windows when the tampered files were active, any installation that checked for an update automatically fetched malicious content. That payload was then instructed to execute by the notification file, running under the privileges of the AOMEI service. Depending on how the service was set up, this could allow system-wide installation.
Timeline, Targets, and Tools
Three specific tampering episodes were verified by Google Threat Intelligence Group (GTIG) and Mandiant:
- May 28, 2026 – 10 minutes (05:40–05:50 UTC)
- July 16, 2026 – 6 minutes (08:33–08:39 UTC)
- July 20, 2026 – 5 minutes (10:35–10:40 UTC)
Within those windows, any Backupper instance reaching out for updates got compromised. The impact spread across at least 11 countries; sectors affected include IT services, telecommunications, and higher education in places like the United States, India, Brazil, Spain, and Türkiye. The actual number is likely higher, as only known telemetry was reviewed.
On affected machines, a downloader dubbed CROSSROAD unpacked a bundle into a local Radmin folder and established a scheduled task to run every three hours. That bundle included a signed version of Radmin (a legitimate remote administration tool) and an attacker-built DLL that in turn loaded an implant known as SHINYROAD. The implant opens a remote shell and can load additional tools, such as a follow-on payload disguised as Nitro PDF via the open-source Adaptix C2 framework. There’s also a silent credential-leak mechanism: during the July 20 window, an invisible pop-up using WebDAV tricked Windows into transmitting user authentication data (NetNTLMv2) without running any suspicious code.
Vendor Response and Remaining Risks
ManageEngine’s analysis first spotted the attack on May 28; by June 7, affected parties had notified AOMEI, which at first claimed that data had been altered in transit. By mid-July, the vendor acknowledged that updates were being served maliciously from its own servers, and corrective action was taken. Nevertheless, researchers have not yet confirmed full containment.
AOMEI’s published changelog for version 8.5.0 (released October 9, 2026) shows no alterations in its verification process for update files. Because the tampering altered server-side files for only short periods, systems that were compromised may now appear normal—genuine updates have been restored. As a result, detection is difficult without digging into logs and checking local copies.
What Organizations Need to Do Now
Even with AOMEI’s update servers fixed, machines hit during the attack remain compromised unless explicitly cleaned. Key indicators to hunt for include:
- Scheduled tasks named
RadminComponentRuntimeorNitroRuntime - Unsigned executables like
upgrade-now.exethat nonetheless carry AOMEI’s publisher signature, or any program running from the html pop-up folder - Malicious files staged under local Radmin application data directories
Network defenses should include blocking connections to identified attacker domains and IPs, disabling outbound SMB and WebDAV to external hosts, and deploying detection rules released by GTIG and ManageEngine. Also, piece together when alerts triggered between April and July to catch those critical moments when the attacks occurred.
Supply chain attacks like this show just how subtle threats can become when update mechanisms lack strong cryptographic protections. That AOMEI’s updater was subverted without exploiting software vulnerabilities underscores how much risk remains—often hidden—whenever software trusts unsigned configuration files. For organizations using AOMEI Backupper or AnyViewer, this incident is a wakeup call: even routine tools must be scrutinized in depth, and cleanup efforts need to be surgical. Going forward, insist on signed update metadata, regular integrity audits, and monitoring for even brief anomalies—because attackers will always look for a narrow window of opportunity.
