A Backup Tool’s Own Update Server Served a Backdoor for Minutes at a Time: The AOMEI Fact File and Hunt List
For a few minutes at a time this spring and summer, AOMEI Backupper’s update servers handed out a backdoor instead of an update. Here is the fact file, and the hunt list for anyone who runs the software.
Most supply chain attacks leave a poisoned file sitting on a server for days. This one was built to vanish. Researchers say someone repeatedly edited the update instructions on AOMEI’s servers, left the change live for five to ten minutes, and then put the genuine files back. Any copy of AOMEI Backupper that happened to check in during one of those windows pulled down a backdoor.
The details below come from The Hacker News’ account of the disclosure, which summarizes joint research from Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine’s Threat Analysis Lab.
The fact file
- Product: AOMEI Backupper, a Windows backup and disk-cloning tool. AOMEI’s remote-desktop product, AnyViewer, uses the same update mechanism, though the detections described involve Backupper.
- Group: tracked by GTIG as UNC7017. No country or known actor has been named.
- Confirmed windows (UTC): May 28, 2026 (05:40–05:50), July 16 (08:33–08:39) and July 20 (10:35–10:40). GTIG believes there were more it did not see, and the researchers urge hunting across the full April-to-July period.
- How it worked: two plain-text settings files tell the program what update to fetch and what pop-up to show. Neither is cryptographically verified, and the checksum meant to vouch for the download lives inside the same unsigned file. No software flaw was exploited and no user had to click anything.
- What landed: a downloader called CROSSROAD set up a scheduled task that runs every three hours, staged a genuine signed copy of the Radmin remote-admin tool, and used it to side-load an attacker DLL that loads a backdoor called SHINYROAD. On some machines a second tool, the open-source Adaptix C2 framework, was later dropped disguised as Nitro PDF software.
- Where: organizations in IT services, telecom and higher education across 11 countries, including the United States. No total count was given.
- Vendor status: AOMEI told Mandiant on July 29 it had secured its servers. ManageEngine says it had not independently confirmed containment, and The Hacker News found no change to how Backupper verifies updates in the changelog through version 8.5.0 (October 9).
The part that makes this hard to catch
Because the files flipped back within minutes, the vendor’s download site looked clean almost all the time. The researchers say analysts dismissed real alerts as false positives for exactly that reason. The downloader also restored the local update file after it ran, so an infected PC can look normal. A server-side fix does nothing for a machine that was already hit.
The July 20 window carried a second trick: an invisible one-pixel pop-up pointing at a remote file over WebDAV. Simply rendering it could make Windows send the signed-in user’s NetNTLMv2 authentication response to the attacker, where it could be cracked offline or reused. No program had to run for that to happen.
The hunt list
- Find every machine with AOMEI Backupper or AnyViewer installed, including ones a staff member installed on their own.
- Look for scheduled tasks named RadminComponentRuntime or NitroRuntime.
- Look for an unsigned upgrade-now.exe carrying AOMEI’s publisher details, anything executing from Backupper’s html pop-up folder, and unexpected files under the local Radmin application-data folder.
- Block the infrastructure named in the reports: storage-data[.]com and its promotion and aomei subdomains, plus 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117.
- Block outbound SMB (TCP 445) and WebDAV to the internet to shut down the credential-leak trick.
- If an alert fires, preserve the files cached in the program’s own folders and check network logs for what was served at that moment. Do not judge it by what the vendor site shows today.
- GTIG published YARA rules and ManageEngine published Sigma rules; feed them to whatever endpoint or log tool you use.
What this means for your company
Backup and remote-access utilities run with deep privileges and phone home on their own schedule, which makes their update channel a perfect delivery route. Keep an inventory of every agent that updates itself, remove the ones you don’t actively manage, and prefer tools whose updates are code-signed and verified. Blocking outbound SMB and WebDAV at the firewall is a cheap control that also protects you from many unrelated attacks. If AOMEI software was on any company PC between April and July, assume it needs a hunt, not just an upgrade.
Need help hunting for this backdoor or tightening control over self-updating software on your PCs? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
