Attackers hijacked AOMEI Backupper’s update servers to push a backdoor
Between April and July 2026, attackers briefly modified two configuration files on AOMEI’s servers to make Backupper clients download the CROSSROAD and SHINYROAD malware, in windows of five to ten minutes. If you run AOMEI Backupper, hunt for indicators of compromise: a server-side fix does not remove a backdoor already installed.
October 19, 2026. BleepingComputer reveals that AOMEI’s servers were compromised to distribute malware through the built-in promotional feature of Backupper. May 28, 2026. The first captured exposure window, lasting ten minutes. July 16, 2026. ManageEngine captures the malicious configuration changes live. Why it matters: the attack ran for months, in five-to-ten-minute windows, and a server-side fix does not disinfect machines already hit.
A supply chain attack in minute-long windows
The attacks took place between April and July 2026 and targeted the update and notification systems of AOMEI Backupper, the Windows application for backing up data, cloning disks, and restoring systems.
Researchers at ManageEngine’s Threat Analysis Lab (METAL), working with the Google Threat Intelligence Group (GTIG) and Mandiant, attributed the campaign to an actor tracked as UNC7017. The compromised infrastructure served two previously unknown pieces of malware: the CROSSROAD downloader and the SHINYROAD backdoor.
The first detection came on May 28, when ManageEngine saw Backupper suddenly installing Radmin, a legitimate remote-administration tool, on machines at two unrelated companies in different countries. The installation was triggered by AOMEI’s built-in promotion processes, which normally handle downloading and displaying promotional content.
The mechanism: two .ini files and a modified checksum
When researchers first tried to reproduce the behavior on their own systems, they found nothing suspicious: the software contacted AOMEI’s servers and downloaded the legitimate configuration file. The explanation lay in the attack’s discretion.
Rather than permanently replacing the files, the attackers briefly modified two configuration files of the promotion and notification systems:
down_html.ini, which tells Backupper where to download update packages;Notifycfg.ini, which controls notifications and can trigger content to run on the machine.
By modifying these files, the attackers redirected the software toward a malicious ZIP archive, then used the notification mechanism to execute the malware without user interaction. They also modified the expected checksum in the update configuration, so the malicious archive passed the software’s file-verification check.
After the initial reproduction failed, ManageEngine continuously monitored AOMEI’s servers. On July 16, that monitoring captured the malicious modification live. The researchers identified three windows during which the malicious configuration was being served:
- May 28: a ten-minute window (05:40–05:50 UTC);
- July 16: a six-minute window (08:33–08:39 UTC);
- July 20: a five-minute window (10:35–10:40 UTC).
The attackers restored the files to their original form within minutes, making the compromise extremely hard to detect.
An attributed actor, opportunistic victims
Once launched, the CROSSROAD downloader performed reconnaissance on the machine, downloaded additional components, and established persistence through a scheduled task. SHINYROAD, the backdoor, used legitimate Radmin components to load malicious code and open an outbound connection to an attacker-controlled command-and-control server.
On July 20, Google observed a second technique: forcing the software’s notification system to access an attacker-controlled WebDAV resource through an invisible popup, attempting to steal Windows NTLM hashes for later offline cracking.
Affected organizations were identified in the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors including IT services, telecommunications, and higher education. Google warned that the attack was opportunistic: any organization that checked for updates during the brief windows could have been affected.
AOMEI’s response: denial, then investigation
ManageEngine first notified AOMEI on June 7, more than a month before the direct capture. The vendor initially suggested the content may have been intercepted and modified in transit — an explanation the researchers rejected, since both endpoints retrieved the content over HTTPS from AOMEI-owned hostnames, across unrelated network paths, and the executable arrived through the software’s own extraction sequence.
After the July 16 capture, AOMEI said its initial review had found no evidence of a breach, then that its technical team had upgraded its servers and patched potential vulnerabilities. Reached by BleepingComputer, the vendor says it is treating the matter as high priority, with its CTO leading an internal investigation. It has not immediately confirmed how the attackers accessed its infrastructure, or whether the compromise is fully resolved.
What to do now
The decisive point, stressed by ManageEngine: a server-side fix stops new infections but does not remove the backdoor from machines that received it during an earlier window. Remediation must therefore pass through an active hunt on endpoints, not just an update.
Organizations running Backupper should review the indicators of compromise published by Google and ManageEngine: suspicious scheduled tasks, unexpected executables in the AOMEI installation directory, and outbound connections to attacker-controlled infrastructure — notably the address 8.210.84[.]56 and hostnames under storage-data[.]com.
A hunt that starts on the endpoint, not the server
The published indicators are concrete and verifiable without specialist tooling. Three checkpoints are enough for a first pass:
- Scheduled tasks. CROSSROAD persists via a scheduled task. List recent tasks (
schtasks /query /fo LIST /von Windows) and look for a command pointing to an unknown executable in the AOMEI directory. - Unexpected executables. Check the Backupper installation directory for recently added files, especially Radmin binaries or loader components.
- Outbound connections. Watch flows to
8.210.84[.]56and hostnames understorage-data[.]com. A backdoor that never calls home is not a backdoor: the outbound connection is the moment it gives itself away.
The NTLM hash theft on July 20 deserves separate treatment. If a machine executed the poisoned notification, its hashes may have been collected and cracked offline. The response is not just rotating the affected passwords: it is enabling Kerberos authentication where possible and shrinking the surface of local-privilege accounts.
The pattern is not isolated. The same period saw Ledger ask sellers across Asia to halt sales after a supply-chain compromise, and the ConnectWise cloud backup breach that reached 173 Microsoft 365 tenants. What distinguishes the UNC7017 campaign is its patience: rather than a broad, loud compromise, it traded a few minutes of control over two configuration files, several times, spread across months. That is the signature teams keep missing — a breach that looks like nothing for months and is then already everywhere.
Detection is harder than for a classic update poisoning because the window is measured in minutes and the payload is restored to a pristine state. The only reliable evidence sits on the endpoint — the scheduled task, the unexpected binary, the odd outbound flow — which is why the hunt, not the patch, is the real remediation.
Defenders who rely on a vendor’s reassurance will keep missing campaigns like this one: the evidence of UNC7017’s work was never on the server, it sat on the endpoints — in a scheduled task, a stray binary, and a quiet outbound connection that no patch will ever remove.
Verdict
If you run AOMEI Backupper, do not settle for updating it: run a compromise hunt on the endpoints, starting with scheduled tasks and unknown executables in the installation directory, and rotate any NTLM hashes that may have been exposed during the July 20 window. If you manage a larger Windows estate, take the structural lesson: backup software that downloads and executes promotional content is a supply-chain surface in its own right — treat its updates with the same suspicion you apply to an antivirus.