AOMEI Backupper Update Servers Hijacked for Minutes to Plant Backdoor on Windows

Between May and July 2026, attackers briefly swapped two unsigned configuration files on AOMEI Backupper’s own update servers, delivering a backdoor to any Windows machine that polled for an update during a five-to-ten-minute window. GTIG and Mandiant confirmed three such windows (May 28, July 16, and July 20, 2026) and said more likely went undetected. The attack required no vulnerability and no user action: the backup program simply fetched the tampered files over HTTPS and executed the attacker’s package with the privileges of the AOMEI service. GTIG identified affected organizations in IT services, telecommunications, and higher education across 11 countries and tracks the group as UNC7017. The disclosure was published jointly by GTIG, Mandiant, and ManageEngine’s Threat Analysis Lab.

The payload, dubbed CROSSROAD, unpacked a genuine signed copy of Radmin alongside an attacker-built DLL that loads the SHINYROAD implant, giving a remote shell and code-fetch capability via a single hard-coded address. In some cases GTIG later observed a second tool, the open-source Adaptix C2 framework disguised as Nitro PDF, pushed on top. A separate trick in the July 20 window used a one-pixel pop-up pointing to a WebDAV file to capture the logged-in user’s NetNTLMv2 token without executing any program. The downloader then deleted itself and restored the local update file to its genuine contents, so infected machines can appear clean while the vendor’s servers also serve legitimate files.

ManageEngine’s lab first flagged the activity on May 28 and notified AOMEI on June 7; AOMEI initially blamed interception in transit, a claim the lab said the evidence did not support. Mandiant notified AOMEI on July 17, and AOMEI reported corrective server-side action on July 29, though ManageEngine had not independently confirmed containment as of publication. Neither report identifies how the attacker gained write access to AOMEI’s servers, and AOMEI’s changelog through version 8.5.0 (October 9) shows no change to update verification. GTIG and Mandiant stress that a fixed server does not remediate already-compromised machines and urge organizations to hunt across the April-to-July period for the RadminComponentRuntime scheduled task, unsigned upgrade-now.exe files, and the attacker’s infrastructure.