Between April and July 2026, attackers compromised the update and notification infrastructure belonging to AOMEI Technology, maker of AOMEI Backupper, a Windows backup tool the company says is used by more than 100 million people. The same infrastructure also serves AnyViewer, AOMEI's remote desktop product.
The attack was unusual in its discipline. Rather than replacing files permanently, the attackers edited two configuration files, left them in place for five to ten minutes, then restored the originals. Any copy of Backupper that happened to check in during one of those windows downloaded and ran a malicious package. Every copy that checked a minute later received the genuine file.
The findings come from coordinated reporting by Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine's Threat Analysis Lab (METAL). Google tracks the malware chain as CROSSROAD and SHINYROAD, and attributes the activity to a group it calls UNC7017.
Two clarifications on the framing. The promotional notification feature was the trigger, but the attackers manipulated the download instructions as well, so this was not purely a case of a poisoned advert. And the server-side problem has been fixed: AOMEI told researchers in late July that it had secured its infrastructure. The customer-side problem has not.
What happened
How the attack worked
AOMEI Backupper runs background processes, Backupper.exe and ABNotify.exe, which regularly contact AOMEI's servers over HTTPS to check for updates and fetch promotional pop-ups. That is routine, expected behaviour for almost any consumer software.
The attackers gained the ability to edit files on those servers and altered two of them:
File | Normal purpose | What the attackers did |
|---|---|---|
down_html.ini | Tells Backupper the package version, checksum and where to download updates | Redirected downloads to attacker-controlled infrastructure |
Notifycfg.ini | Drives the notification and promotional pop-up feature | Used to trigger execution of the downloaded payload |
Because the software trusted its own vendor's configuration, the malicious ZIP archive was accepted as genuine and executed without any user interaction. There was no prompt to click and no decision for the victim to make.
The short bursts
Researchers identified three confirmed tampering windows, lasting roughly ten, six and five minutes. Outside those windows, the servers returned entirely legitimate files.
This is the detail that makes the campaign notable. It defeated the obvious investigative method: when researchers went to check AOMEI's servers after the fact, they saw only clean configuration. METAL initially failed to reproduce the attack for exactly this reason, and had to switch to continuous monitoring of the servers to catch a window in progress.
Crucially, the brief windows made the delivery temporary, not the infection. A machine that received malicious instructions kept running the malware long after AOMEI's servers were restored.
The malware
The chain began with an unsigned downloader named upgrade-now.exe, delivered inside a ZIP archive. It staged a further payload, established persistence, and then deleted itself. Its absence from a machine therefore proves nothing.
Persistence was established through a scheduled task named RadminComponentRuntime. The end result was a remote-access backdoor allowing attackers to execute commands and install further malware.
Researchers did not classify the payload as ransomware or an infostealer, but a backdoor of this kind is a staging point for whatever the operator chooses next.
One aggravating factor: because AOMEI's processes run under a service (ABService.exe), the malware may have started with elevated privileges without needing to escalate on its own.
How it was found
METAL first noticed something wrong on 28 May, when AOMEI Backupper installed remote administration software on the computers of two unrelated customers in different countries. Two unconnected victims receiving the same unexpected software from the same trusted application is a strong signal, and it is what opened the investigation.
A second, quieter risk
In July, the tampering reportedly included a configuration pointing to an attacker-controlled network path. Windows will attempt to authenticate automatically to such a path, which can expose NetNTLMv2 authentication material without any malware running at all. That material can be used for offline password cracking or authentication relay attacks.
This means a machine may have been exposed to credential theft even if no malicious executable ever landed on it.
What AOMEI has done
AOMEI told researchers it has upgraded its servers, patched potential vulnerabilities, verified the integrity of its hosted files and taken corrective action on its distribution infrastructure. The company has said its CTO is investigating.
What remains undisclosed is how the attackers got in. The initial breach vector has not been published.
Why it matters
The trust model is the vulnerability. Nothing here required a software flaw on the victim's machine. The software did exactly what it was built to do: contact its vendor, accept the vendor's instructions, and run what it was told to run. Supply chain attacks of this shape bypass user judgment entirely, because the user is never consulted.
Backup software is an unusually attractive target. It is installed widely, runs with elevated privileges, operates in the background, is trusted by definition, and reaches the data people care most about. There is a bleak irony in the product meant to rescue you from an incident being the vehicle for one.
Short bursts defeat snapshot investigation. The five-minute window is a technique worth internalising. Any security process that checks a remote resource periodically, rather than continuously, can be stepped around by an attacker patient enough to wait for the gaps.
Exposure was opportunistic and the true scale is unknown. GTIG notes that any system checking in during a tampering window could have been infected, so the real reach may be wider than confirmed cases. There is no published victim list, and there may never be one.
Vendor remediation is not customer remediation. This is the single most misunderstood point in the coverage. AOMEI securing its servers stops new infections. It does nothing for a machine already carrying the backdoor.
Who is affected
Users of AOMEI Backupper, reportedly version 8.3.0 and later, whose software checked in during one of the tampering windows between April and July 2026.
Users of AnyViewer, since the compromised infrastructure also served that product.
Organisations running AOMEI products on endpoints or servers, particularly where the software runs as a service with elevated rights.
Anyone whose machine may have been pointed at the attacker's network path in July, who should treat it as a potential credential exposure rather than a malware question.
Managed service providers deploying AOMEI tooling across client estates, where one compromised configuration could affect many machines.
What organisations should do
Check for infection
Inspect the AOMEI Backupper installation folder, typically
C:\Program Files (x86)\AOMEI\AOMEI Backupper\, including version-specifichtmlandTmphtmlsubfolders, for an unsigned upgrade-now.exe or an unexpected upgrade-now.zip.Remember the downloader deletes itself. Its absence does not mean the machine is clean. Keep looking.
Check Task Scheduler for a task named RadminComponentRuntime, which is the persistence mechanism reported by researchers.
Look for connections to attacker infrastructure, including the domain
aomei.storage-data.com, in DNS and proxy logs going back to April 2026.Review the full indicators of compromise published by Google and ManageEngine, including suspicious scheduled tasks and unexpected executables in AOMEI directories.
Run a full scan with updated security software. Malwarebytes detects the initial downloader as
Malware.AI.4006642887.
If you find something
Treat it as a full compromise, not a malware cleanup. The payload is a remote-access backdoor that may have run with system-level privileges and installed additional tooling.
Assume credential exposure. Rotate credentials used on or accessible from the affected machine, and review authentication logs for relay or cracking attempts, particularly around July 2026.
Rebuild rather than clean where the machine is sensitive or the dwell time is long.
Structural lessons
Monitor outbound connections from trusted applications. The infection arrived over HTTPS from a legitimate vendor domain, so reputation filtering offered no protection. Behavioural detection and egress monitoring did.
Apply application allowlisting, which would have blocked an unsigned executable appearing in a program directory regardless of where it came from.
Restrict which software can run with service-level privileges, and review what your backup, remote-access and management agents are permitted to execute.
Inventory auto-updating software across your estate. Every background updater is a standing, trusted, unattended execution path from a third party straight into your endpoints.
Ask vendors how they protect their own build and distribution infrastructure, and treat the answer as part of your supplier assessment.
Final thoughts
The attackers did not need an exploit, a phishing email or a careless user. They needed edit access to two text files on somebody else's server, and the patience to use it for five minutes at a time.
The lesson: your auto-update channel is a permanent, privileged, unattended execution path into your network, controlled by somebody else. It is also one of the few things security teams rarely monitor, because the entire point of an updater is that it works without supervision. Every piece of software with a background updater extends that same trust, and you are relying on each of those vendors to keep their servers clean.
The second lesson is operational and urgent. Server-side remediation is not endpoint remediation. AOMEI has fixed its infrastructure, and that fact will reassure a lot of people who should not be reassured. If your machine was listening during one of three short windows between April and July, it may still be carrying a backdoor that deleted its own installer months ago.
Two things worth doing this week: check your AOMEI directories and Task Scheduler against the published indicators, and make a list of every application on your estate that updates itself automatically.
