An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered.
Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals. The tampered files belong to the software’s update and promotional pop-up mechanism, which periodically fetches instructions from AOMEI’s servers. The activity was observed on AOMEI Backupper version 8.3.0 and later.
Three “tampering” windows have been directly confirmed: May 28, July 16 and July 20. Any copy of the software that checked in during one of those windows was covertly directed to download and run a malicious package from attacker-controlled locations instead of legitimate content from AOMEI.
How the attack was discovered
ManageEngine’s endpoint detection software first recorded signs of the attack on May 28, when it logged AOMEI Backupper installing Radmin, a commercial remote-administration tool, on two unrelated customer machines in different countries.
Both environments were running in audit mode, so the activity was logged but not blocked. One customer raised the alert on June 7, and ManageEngine’s Threat Analysis Lab (METAL) notified AOMEI the same day.
AOMEI’s initial explanation was that the content had been tampered with in transit, but METAL disagreed.
“Both endpoints had retrieved the content over HTTPS from AOMEI-owned hostnames, across different countries and unrelated network paths, and the executable had arrived through the application’s own extraction sequence rather than being written directly to disk by an external process. The content had been altered before it reached either endpoint, within the vendor-hosted delivery path,” ManageEngine researchers noted.
After that first alert from the customer, the lab polled the same AOMEI delivery URLs, but it got only clean content. The researchers then tracked down a matching sample of the dropper on VirusTotal, confirmed it was malicious, and began monitoring the servers continuously.
On July 16, they caught a malicious version being served for a few minutes before it disappeared. They shared the evidence with AOMEI, which said its initial review had found no evidence of a breach.
Google Threat Intelligence Group (GTIG) and Mandiant captured another such window on July 20.
The attack used two files. One (down_html.ini) told the software which package to download and which checksum to expect, and the attackers pointed it to locations they controlled and supplied a matching checksum, so the malicious package passed validation.
The other file (Notifycfg.ini) controls the program’s pop-up notifications. The attackers set it to open a page in an invisible window, and that page launched a dropper Google researchers call CROSSROAD.
AOMEI software update mechanism: Normal vs. malicious flow (Source: GTIG)
The dropper stopped if the machine was located in China, if it couldn’t determine the machine’s location, or if certain security products were present. On systems that passed those checks, it installed genuine Radmin Server along with a backdoor dubbed SHINYROAD, set up a scheduled task to launch the backdoor every three hours, and then deleted itself.
In the July 20 window, the attackers also used the pop-up channel to force machines to authenticate to an attacker-controlled WebDAV server, leaking the logged-in user’s NetNTLMv2 password hash. Because this required no malicious code to run, machines on which the dropper was blocked may still have exposed credentials.
Who is behind it, and who was hit
Google tracks the attackers as UNC7017 and has not linked them to any country or known group.
Confirmed victims include IT services, telecommunications and higher education organizations in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.
“That said, because the campaign attempted to deliver malware to any system polling the update distribution servers during the threat actor’s tampering windows, victimology was opportunistic and likely extends more broadly than the organizations we directly identified,” Google researchers added.
Mandiant notified AOMEI on July 17, and the vendor said on July 29 that it had taken corrective action.
How the attackers gained access to AOMEI’s servers has yet to be disclosed. AOMEI told BleepingComputer that it has classified the reports as a high-priority matter, that its CTO is leading an investigation, and that it will share more information when it has it.
In the meantime, organizations using AOMEI Backupper should leverage the indicators of compromise shared by ManageEngine and Google to check whether they were among the victims. If they were, a deeper investigation and incident response are needed.
Researchers say AOMEI AnyViewer, which relies on the same update mechanism, was also targeted, so its users should check as well.
Malwarebytes has laid out steps consumers can take to verify whether they have been compromised.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
