AOMEI Backupper update tampering delivered a backdoor in brief attack windows
A short-lived compromise of AOMEI's update infrastructure could have delivered a backdoor to Windows machines that checked for updates during five- to 10-minute attack windows.
AOMEI Backupper users may have downloaded a backdoor through the program's own update and promotional systems during several brief server-tampering windows in 2026. Google Threat Intelligence Group (GTIG) and Mandiant say the campaign targeted AOMEI Technology's update infrastructure between April and July, while ManageEngine's Threat Analysis Lab independently reconstructed the infection chain on Windows endpoints. 12
The attackers did not need to exploit a software vulnerability or persuade users to click a malicious attachment. Instead, they briefly altered configuration files served by AOMEI's infrastructure. A Backupper client checking in during one of those windows could be directed to an attacker-controlled package, while the companion notification service could be instructed to launch content from the same local folder. 12
How the AOMEI attack worked
The two important files were `down_html.ini`, which controlled the package URL and checksum, and `Notifycfg.ini`, which controlled promotional pop-ups and actions. GTIG says the client trusted both files without an independent cryptographic signature. That meant an attacker who could change the configuration could also change the download instruction and the value used to validate it. 1
GTIG confirmed exposure windows on 28 May, 16 July and 20 July, lasting between five and 10 minutes. The campaign was opportunistic: a machine that checked before or after a window received clean files, which made the compromise unusually difficult to spot through ordinary point-in-time checks. Organisations in 11 countries were identified in the available telemetry, although the researchers warn that the true reach may be larger. 1
ManageEngine identified the resulting chain as the CROSSROAD downloader and SHINYROAD backdoor, tracked alongside the activity cluster UNC7017. The downloader could install a scheduled task and stage a legitimate Radmin launcher beside an attacker-built DLL. That DLL loaded the backdoor, which provided remote-shell capabilities and could fetch further code. The researchers also found a separate WebDAV-based trick capable of causing a Windows machine to send an NTLMv2 authentication response while rendering an invisible one-pixel pop-up. 2
AOMEI has reported taking corrective action on its servers. However, GTIG, Mandiant and ManageEngine all stress that a server-side fix does not clean a machine that already received the malicious package. The current Backupper changelog lists version 8.5.0, released on 9 October, but does not describe a fix for the update-verification weakness. 3
What affected organisations should check
Security teams should investigate machines that ran AOMEI Backupper during the reported period rather than relying on the vendor's current download page. GTIG and ManageEngine recommend checking cached application files, network logs and endpoint telemetry for the relevant windows. Indicators include the scheduled tasks `RadminComponentRuntime` and `NitroRuntime`, an unsigned `upgrade-now.exe`, unexpected files in Backupper's HTML or Radmin application-data folders, and connections to the infrastructure listed in the research. 12
They should also review outbound SMB and WebDAV traffic to external addresses, preserve evidence before cleaning a suspected endpoint, and use the detection rules published with the original research. The reports do not establish that every Backupper installation was affected, so the right response is targeted investigation rather than assuming that installing the latest version alone settles the matter.
Our opinion
This is a useful reminder that software updates are only as trustworthy as the system that tells the updater what to download. The short exposure windows make the campaign particularly nasty: a clean check today does not prove that an endpoint was clean when it checked last month. AOMEI's reported server-side remediation matters, but organisations should treat it as the start of an investigation, not the conclusion. The clearest defensive lesson is to authenticate update instructions independently and keep promotional content firmly away from any path where the application can execute code.