AOMEI Backupper Update Servers Served a Backdoor in Windows of Five to Ten Minutes

TL;DR

• what: The group GTIG tracks as UNC7017 changed AOMEI Backupper's unsigned update and notification files on AOMEI's own servers for minutes at a time, and any client that polled during those minutes downloaded and ran a backdoor.
• impact: Affected machines got the CROSSROAD downloader, the SHINYROAD implant launched through signed Radmin with a planted DLL, and in some cases Adaptix C2. A July 20 change could also leak NetNTLMv2 hashes without running any program.
• fix: AOMEI told Mandiant on July 29 that it had taken corrective action on its servers, but that does not remove the implant from machines already compromised, and neither report names which Backupper versions are affected.
• who: Any organization running AOMEI Backupper, and possibly AnyViewer, which uses the same update flow, with confirmed victims in IT services, telecom and higher education across 11 countries.

For three confirmed stretches of five to ten minutes between May and July 2026, AOMEI's own update servers handed out a backdoor. Any copy of AOMEI Backupper that checked for updates inside one of those windows downloaded and ran the attacker's package with the privileges of the AOMEI service. Copies that checked a minute before or a minute after got clean files. Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine's Threat Analysis Lab disclosed the campaign this week and attribute it to a cluster GTIG tracks as UNC7017. AOMEI says it has fixed its servers. That fix does not touch machines that were already compromised.

Two Unsigned Text Files Were Enough

AOMEI Backupper is Windows backup and disk-cloning software from AOMEI Technology, a vendor registered in Hong Kong. Like AOMEI's AnyViewer remote-desktop tool, it runs background services that poll AOMEI servers over HTTPS for updates and promotional pop-ups. Two files drive that process. down_html.ini names the update package and the checksum used to verify it. Notifycfg.ini tells the pop-up service what to display and what to run.

Neither file is cryptographically signed. The checksum that is supposed to prove the download is genuine sits inside the same unsigned file that names the download, so whoever controls the file controls both. ManageEngine's lab stresses that nothing was exploited: no vulnerability, no user interaction, just an installed and running copy of Backupper. The attacker edited two text files, the client pulled the package into its own folder, and the notification file executed it. On the machines the lab examined, the inherited privileges were enough for system-wide installation, though the lab said that depends on how the AOMEI service is configured.

⚠️ Why point-in-time checks missed it — GTIG called this the first supply chain compromise it has seen built on windows this short, "effectively evading traditional point-in-time triage and automated file scanning." A responder or scanner that fetched the update files outside a window saw only genuine content.

Three Windows, Eleven Countries

GTIG and Mandiant confirmed three tampering windows and said others likely occurred without being observed:

• May 28, 2026: 10 minutes, 05:40 to 05:50 UTC
• July 16, 2026: 6 minutes, 08:33 to 08:39 UTC
• July 20, 2026: 5 minutes, 10:35 to 10:40 UTC

GTIG describes the targeting as opportunistic: whoever polled during the window was hit. Its telemetry found affected organizations in IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It gave no victim total and expects the real number to be higher. AnyViewer uses the same update mechanism, but every detection described involves Backupper. Neither report lists affected versions. ManageEngine examined version 8.3.0. GTIG names no country or known actor behind UNC7017.

The Payload Chain: CROSSROAD to SHINYROAD to Adaptix

The first stage, a downloader GTIG calls CROSSROAD, unpacks a bundle into a local Radmin folder, creates a scheduled task that runs every three hours, and deletes itself. The bundle contains a genuine, signed copy of Radmin, the commercial remote-administration tool. ManageEngine found Radmin staged but never activated: no listener, no configuration, no new account. Its purpose is to act as a trusted loader.

The scheduled task launches signed Radmin, which side-loads an attacker-built DLL placed beside it, which loads the SHINYROAD implant. SHINYROAD provides a remote shell and can fetch and execute new code on command. It beacons to one hard-coded address with no fallback, so blocking that single address cuts the operator off.

CROSSROAD is selective. It checks geolocation and exits on machines in China, and ManageEngine says it also exits when it detects specific security agents. On hosts that passed those checks, GTIG later saw a second stage pushed on top of SHINYROAD: the open-source Adaptix C2 framework, disguised as Nitro PDF software.

July 20: Credential Theft With No Code Execution

The July 20 window carried a second technique. The tampered Notifycfg.ini opened an invisible one-pixel pop-up pointing at a file on an attacker server over WebDAV. Rendering it can cause Windows to send the logged-in user's NetNTLMv2 authentication response to the attacker, who can crack it offline or attempt to relay it. Nothing appears on screen. Because no program has to run, a host where application control or EDR blocked the backdoor could still have leaked that hash.

Two separate exposures — A machine that polled on July 20 faces two questions: was the implant installed, and was a user's NetNTLMv2 response sent out? Blocking the first does not rule out the second.

Disclosure Timeline

ManageEngine's endpoint product first flagged the activity on May 28, when it recorded AOMEI Backupper installing Radmin at two unrelated customers in different countries. A customer escalated it on June 7, and the lab notified AOMEI the same day. AOMEI first said the content had been intercepted and modified in transit. The lab rejected that: both machines fetched the files over HTTPS from AOMEI's servers across different countries and networks, through the normal update path. In mid-July, ManageEngine's monitors caught a window as it happened, confirming the tampered content was being served from AOMEI's side.

Mandiant notified AOMEI on July 17 and shared indicators. On July 29, AOMEI told Mandiant it had taken corrective action. The reports do not say how the servers were compromised, and the update design itself, unsigned config files carrying their own checksums, has not been described as changed.

RedEye Assessment

This campaign shows that software trust depends on how updates are verified, not only on code quality. Backupper had no exploitable bug. It had an update channel that trusted any server-side content, and that runs with elevated privileges on backup infrastructure, which usually touches every critical volume. UNC7017 needed fewer than 25 confirmed minutes of server access to reach organizations in 11 countries, and short windows defeated the retrospective scanning most teams rely on. The server-side fix closes the door going forward. It does nothing for hosts that polled during a window, which keep a scheduled task, a side-loaded DLL and a live implant until someone finds them. With no published version range and an admission that more windows probably occurred, the exposure period should be treated as May through late July 2026, not as three isolated windows.

Originally published on RedEye Threat Intelligence.