Attackers Tampered With AOMEI Backupper Updates to Deliver a Backdoor
Summary
Researchers say attackers altered AOMEI’s update files in brief windows from May to July 2026, delivering a backdoor and potentially stealing authentication responses. AOMEI reported securing its servers, but infected machines may remain compromised.
Key points
- Attackers altered two unsigned files on AOMEI’s update servers; Backupper did not cryptographically verify them, allowing affected installations to download and run a backdoor.
- GTIG and Mandiant confirmed three tampering windows between May and July 2026; other windows may have occurred. Only systems that checked for updates during a window were affected.
- GTIG attributed the campaign to UNC7017 and identified affected organizations in 11 countries, but gave no total and said the number may be higher.
- The CROSSROAD downloader installed a scheduled task that launched a signed Radmin program alongside an attacker-built DLL and the SHINYROAD implant, which provides remote-shell access and can run downloaded code.
- A July 20 update-file change could prompt Windows to send a logged-in user's NetNTLMv2 response to an attacker-controlled address, even if the backdoor was blocked.
- AOMEI told Mandiant it took corrective server-side action, but ManageEngine had not independently confirmed containment; server fixes do not remove malware from previously affected machines.
- Researchers advise organizations to investigate AOMEI systems across April–July, preserve cached update files, review network logs, and block identified infrastructure and outbound SMB and WebDAV to external addresses.
Article Details
- Attack Vectors
- Attackers altered unsigned update and notification files on AOMEI's servers during brief windows, causing Backupper clients that checked for updates during those windows to download and run a backdoor.
- A scheduled task launched a signed Radmin executable that loaded an attacker-built DLL from the same directory, which then loaded the SHINYROAD implant.
- A modified notification file opened an invisible, one-pixel pop-up referencing a remote file over WebDAV, potentially causing Windows to send the logged-in user's NetNTLMv2 authentication response to the attacker.
- On some machines, attackers subsequently delivered Adaptix C2 disguised as Nitro PDF software.
- Defensive Notes
- Hunt across the full April-to-July period; a server-side fix does not remove backdoors already installed.
- Preserve update files cached in the program's folders and correlate them with network logs from the time an alert fired; the vendor's current download page may show only clean files.
- Investigate scheduled tasks and the Radmin, attacker-built DLL, and SHINYROAD loading chain.
- Block the attacker infrastructure identified in the reports, and block outbound SMB (TCP 445) and WebDAV to external addresses to disrupt the credential-theft technique.
- Do not assume the compromise is contained solely because AOMEI reported corrective server-side action; ManageEngine said it had not independently confirmed containment.
MITRE ATT&CK
T1053.005 · Scheduled TaskThe CROSSROAD bundle created a scheduled task configured to run every three hours.T1105 · Ingress Tool TransferThe attacker delivered a bundle containing CROSSROAD and, on some machines, later pushed Adaptix C2 over SHINYROAD.T1187 · Forced AuthenticationA modified notification file opened an invisible pop-up referencing a remote WebDAV file, potentially inducing Windows to send a NetNTLMv2 authentication response.T1195.002 · Compromise Software Supply ChainAttackers tampered with AOMEI's update files on vendor servers so Backupper clients checking during brief windows would download and run a backdoor.T1574.002 · DLL Side-LoadingThe scheduled task ran signed Radmin, which loaded an attacker-built DLL placed beside it; that DLL loaded the SHINYROAD implant.
Threat Actors
Malware
CROSSROADOn a machine that pulled the package, a downloader that GTIG calls CROSSROAD unpacked a bundle into a local Radmin folder, created a scheduled task set to run every three hours, and then deleted itself from disk.SHINYROADthe signed Radmin program, which loads an attacker-built DLL placed beside it, which in turn loads the SHINYROAD implant. The implant gives a remote shell and can fetch and run new code on command. It talks to a
Vendors
Products
AnyViewermade by AOMEI Technology, a vendor registered in Hong Kong. Like the company's remote-desktop tool AnyViewer, it runs background services that regularly check AOMEI's servers over HTTPS for software updates andAOMEI BackupperAttackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backupMicrosoft Windowsrepeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backupNitro PDFsaw a second tool pushed down on top of SHINYROAD, the open-source Adaptix C2 framework, disguised as Nitro PDF software.
Tools
Adaptix C2that passed those checks, GTIG later saw a second tool pushed down on top of SHINYROAD, the open-source Adaptix C2 framework, disguised as Nitro PDF software.RadminOn a machine that pulled the package, a downloader that GTIG calls CROSSROAD unpacked a bundle into a local Radmin folder, created a scheduled task set to run every three hours, and then deleted itself from disk.SigmaGTIG and ManageEngine each published detection rules with their reports, YARA rules from GTIG and Sigma rules from the lab. Both sets are the researchers' own and have not been tested by The Hacker News.YARAGTIG and ManageEngine each published detection rules with their reports, YARA rules from GTIG and Sigma rules from the lab. Both sets are the researchers' own and have not been tested by The Hacker News.
Countries
Australiaaffected organizations in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the UnitedBrazilorganizations in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States.ChinaCROSSROAD runs only in some places. It checks the machine's location and stops if it is in China, and ManageEngine added that it also stops if it finds particular security agents on the host. On machines that passedIndiain IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gavePakistanin IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no totalPortugaltelecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no total and saidSingaporeand higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no total and said the realSouth Africaand higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no total and said the real number isSpaineducation across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no total and said the real number is likely higher.Switzerlandacross 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no total and said the real number is likely higher.Türkiye11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no total and said the real number is likely higher.United StatesBrazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no total and said the real number is likely higher.
Industries
Higher EducationFrom its own telemetry, GTIG identified affected organizations in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain,IT servicesFrom its own telemetry, GTIG identified affected organizations in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain,TelecommunicationsFrom its own telemetry, GTIG identified affected organizations in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain,