Hackers hijacked AOMEI Backupper's update servers in five-minute windows to plant a backdoor

Attackers compromised the update infrastructure for AOMEI Backupper, a widely used backup application, and used it to push a backdoor to installed copies during short windows between May and July 2026 — sometimes for as little as five to ten minutes at a time. Google's Threat Intelligence Group (GTIG), working with Mandiant and ManageEngine's Threat Analysis Lab, disclosed the campaign this week, attributing it to an actor it tracks as UNC7017.

The attack is notable for what it didn't need: no software vulnerability at all. AOMEI Backupper checks two plain configuration files on the vendor's servers — one that tells it which package to download, another that controls pop-up content and what gets executed. Neither file is cryptographically signed, and the checksum meant to verify a legitimate download sits inside the very same unsigned file that names it. Attackers simply edited those two files for a few minutes at a time, had the update mechanism fetch malicious payloads, then reverted the files before anyone noticed — a pattern GTIG says also touched AOMEI's AnyViewer remote-access tool.

Machines that checked for updates during one of the tampered windows received the CROSSROAD downloader, followed by the SHINYROAD implant, launched through a legitimately signed Radmin remote-access binary alongside a planted malicious DLL — a technique known as DLL sideloading that lets malware run under the cover of trusted, signed software. In at least one window, attackers skipped installing anything at all and instead harvested NetNTLMv2 authentication hashes directly, which can potentially be cracked or relayed to move laterally across a Windows network.

GTIG says the confirmed victims span IT services, telecommunications, and higher education across 11 countries — a victim profile consistent with an espionage-motivated supply-chain operation rather than opportunistic crime. The first public sign of trouble came when ManageEngine's own endpoint security software flagged something unusual: AOMEI Backupper suddenly installing Radmin, a legitimate but unrelated remote-administration tool, on machines at two unconnected companies. That anomaly is what triggered the wider investigation.

Mandiant notified AOMEI about the tampered configuration files on July 17; the company confirmed corrective action on its servers on July 29. But fixing the server doesn't undo infections that already happened — any machine that fetched an update during one of the malicious windows between May and July may still be carrying the backdoor, regardless of whether it's running the latest version today. Security teams are advised to hunt for unexpected scheduled tasks, unfamiliar executables inside AOMEI installation directories, and signs of Radmin or Adaptix C2 activity rather than assume a clean update history means a clean machine.

The technique itself isn't new — unsigned, unauthenticated update channels have been a soft target for years, from the 2018 Asus Live Update compromise that infected roughly 70,000 devices to a similar hijack of Notepad++'s update mechanism reported earlier this year. What distinguishes the AOMEI case is how little attackers needed to touch: no exploit, no credential theft to get in, just two text files and a few unmonitored minutes, repeated until it worked.

Source: Google Threat Intelligence Group, Mandiant, and ManageEngine Threat Analysis Lab disclosures, reported by The Hacker News and Malwarebytes, October 19, 2026.