AOMEI Backupper Update Servers Briefly Hijacked to Push a Backdoor

For a few minutes at a time between May and July 2026, AOMEI's own update servers handed out a backdoor instead of a software update. Any Windows machine running AOMEI Backupper that happened to check in during one of those windows installed it automatically, with no click and no software bug required.

The campaign was disclosed this week by Google Threat Intelligence Group (GTIG) and Mandiant, together with ManageEngine's Threat Analysis Lab. AOMEI says it has secured its servers. That fix does not clean machines that were already compromised.

What happened

AOMEI Backupper, a popular Windows backup and disk-cloning tool from Hong Kong-based AOMEI Technology, runs background services that regularly contact the vendor over HTTPS. They fetch two small configuration files:

• down_html.ini: tells the client which update package to download and which checksum to expect.
• Notifycfg.ini: tells the notification service what to display and what to run.

Neither file is cryptographically signed. The checksum that is meant to prove the download is genuine sits inside the same unsigned file that points to it. An attacker who can edit those two text files on the server controls what the client downloads and runs. This is a design weakness in the update trust model, not a memory-corruption bug.

The researchers confirmed three short tampering windows and believe there were more:

Clients that polled before or after a window got clean files. That is why the attack was hard to spot: checking the vendor's site afterwards almost always showed nothing wrong.

The infection chain

1. A tampered package lands in the Backupper folder and the notification config launches it with the privileges of the AOMEI process. On the machines examined, that was enough for system-wide installation.
2. A downloader that GTIG tracks as CROSSROAD stages a genuine, signed copy of Radmin, adds a scheduled task that runs every three hours, then deletes itself.
3. The signed Radmin binary side-loads an attacker-built DLL that loads the SHINYROAD implant. SHINYROAD gives the attacker a remote shell and can fetch and run new code. Radmin itself was never configured as a remote-access tool; it is only a trusted launcher.
4. CROSSROAD exits if the host appears to be in China or if certain security agents are present. On some hosts that passed those checks, a second-stage Adaptix C2 agent posing as Nitro PDF software was later deployed.

The 20 July window added a code-free trick. The notification config opened an invisible one-pixel pop-up that referenced a file on an attacker-controlled WebDAV server. Rendering it can make Windows leak the logged-in user's NetNTLMv2 challenge response, which can be cracked offline or relayed. Hosts that blocked the backdoor could still have leaked credentials this way.

Why it matters

• Opportunistic, broad reach. GTIG saw victims in IT services, telecom and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the US. It expects the real number to be higher.
• Attribution is open. GTIG tracks the activity as UNC7017 and has not linked it to a country or a known group.
• The root cause is unclear. Neither report explains how the attacker got write access to AOMEI's servers. ManageEngine says it has not independently confirmed that the compromise is contained. As of 16 October, Backupper's changelog up to the current 8.5.0 release lists no change to how updates are verified.
• Scope is fuzzy. The affected Backupper versions are not listed (8.3.0 was analysed). AOMEI's AnyViewer remote-desktop tool uses the same update flow, although the detections involve Backupper.

Short, rotating windows like these defeat point-in-time triage. A single SOC alert gets checked against a clean download page and closed as a false positive.

What to do

Assume exposure if AOMEI software was running between April and July 2026, and hunt for it. A server-side fix does not remove an existing implant. The downloader also restores the local update file, so infected hosts can look normal.

On endpoints, look for:

• Scheduled tasks named RadminComponentRuntime or NitroRuntime
• An unsigned upgrade-now.exe carrying AOMEI publisher metadata, or any executable running from Backupper's HTML pop-up folder
• Unexpected files staged under the local Radmin application-data folder
• Earlier alerts on AOMEI processes that were closed as false positives. Re-open them and check what was actually served at the time of the alert.

On the network:

• Block the published infrastructure: storage-data[.]com, promotion.storage-data[.]com, aomei.storage-data[.]com, 8.210.84[.]56, 8.218.65[.]184, 47.239.60[.]117
• Block outbound SMB (TCP 445) and WebDAV to the internet to shut down the NetNTLMv2 leak path
• Search proxy and DNS logs for these indicators back to April 2026

For the longer term:

• Preserve cached files in the application's own folders before cleaning up, because they are your evidence.
• Use the YARA (GTIG) and Sigma (ManageEngine) rules published with the research. Test them in your environment first.
• Until AOMEI documents signed update verification, consider disabling automatic updates and in-app notifications, or limiting the tool's outbound access.
• Add "how does this agent verify its updates?" to your third-party software reviews. Any always-on updater is part of your supply chain.

Need help hunting for this across your fleet or reviewing third-party updaters in your environment? The 4Tify team can help.

Originally reported by The Hacker News. Technical findings from Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab.