Attackers backdoor AOMEI Backupper updates in a stealthy supply-chain compromise

On 16 October 2026, researchers at Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine's Threat Analysis Lab disclosed that attackers had quietly subverted the software-update mechanism of AOMEI Backupper, a widely used Windows backup and disk-cloning tool made by Hong Kong-registered AOMEI Technology. Rather than exploiting a vulnerability, the intruders altered two unsigned configuration files on AOMEI's own servers — one naming the update package and its checksum, the other controlling a pop-up service — so that any installation checking for updates during narrow windows downloaded and executed a malicious package with the privileges of the AOMEI process.

GTIG confirmed three brief tampering windows between May and July 2026, each lasting only five to ten minutes: 28 May, 16 July, and 20 July. Copies that checked for updates outside those windows received genuine files, which helped the operation evade notice; GTIG said additional windows it did not observe likely occurred. The group is tracked as UNC7017, and the researchers attributed no country or known actor, describing the targeting as opportunistic.

The malware chain

The malicious package used a downloader dubbed CROSSROAD, which unpacked a bundle containing a legitimately signed copy of Radmin, created a scheduled task to run every three hours, and then deleted itself. The task side-loaded an attacker-supplied DLL that deployed an implant called SHINYROAD, which beaconed to a single hard-coded address; on some machines GTIG also found the open-source Adaptix command-and-control framework disguised as Nitro PDF software. CROSSROAD was built to exit on hosts located in China or running certain security agents. A variant seen on 20 July instead opened a hidden pop-up pointing to an attacker WebDAV server, able to leak a victim's NetNTLMv2 authentication token with no program run at all.

Scope and response

GTIG identified victims in IT services, telecommunications, and higher education across 11 countries — Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States — and said the true figure is likely higher. AOMEI told Mandiant on 29 July that it had secured its servers, but researchers cautioned that a server-side fix does not remove the backdoor from machines already infected, and noted that AOMEI's changelog showed no change to its update-verification process through the current 8.5.0 release. Neither report explained how the attackers gained write access to the update servers.