For a few minutes at a time between May and July 2026, AOMEI Backupper’s own servers instructed the software to install a backdoor. Google’s threat researchers and other security teams disclosed the campaign on October 19. Each tampering window lasted only five to ten minutes before the attacker restored the original files.
AOMEI Backupper is a widely used Windows backup and disk-cloning tool with a free edition, the kind of utility that often lands on work machines without going through IT. Rather than exploiting a flaw in the software, the attacker edited two text files on AOMEI’s servers and let every copy that checked in during those minutes download and run the payload.
AOMEI has since secured its servers and shipped an update that signs the configuration files, but neither fix reaches machines that were already infected.
How Two Text Files Opened the Door
Backupper runs background services that regularly contact AOMEI’s servers for updates and promotional pop-ups. Two configuration files drive that check. The first, down_html.ini, names the package to download and the checksum it should match. The second, Notifycfg.ini, tells the pop-up service what to display and what to run.
Neither file is cryptographically signed, and the checksum meant to prove a download is genuine sits inside the same unsigned file. Whoever controls that file controls both the package and the proof. BleepingComputer reports that the attackers abused a built-in promotional feature to deliver the malware, so a marketing channel ended up launching code on endpoints.
Researchers confirmed three tampering windows on AOMEI’s servers: May 28 (10 minutes), July 16 (6 minutes) and July 20 (5 minutes). Copies that checked in before or after a window received clean files. Confirmed victims include IT services, telecoms and higher education organizations across 11 countries, among them Australia, the US, India and Spain, and the real number is likely higher.
Those short windows also made the attack hard to investigate, since an analyst checking the vendor’s download page after an alert would almost always find genuine files and could easily write off a real detection as a false positive.
What Landed on Infected Machines
On machines that pulled the tampered package, the infection chain was quiet and layered:
- A downloader called CROSSROAD unpacked files into a Radmin folder under the user’s local app data, created a scheduled task that runs every three hours, then deleted itself.
- It also restored the local update file to its genuine contents, so the machine looked normal afterward.
- The scheduled task launches a genuine, signed copy of Radmin, a commercial remote administration tool, which loads an attacker-built DLL placed beside it.
- That DLL loads SHINYROAD, an implant that provides a remote shell and can fetch and run new code on command.
- On some machines, the attackers later added the open-source Adaptix C2 framework, disguised as Nitro PDF software.
Radmin’s own remote control features were staged but never switched on. Its signed binary served mainly as cover for the attacker’s code, a familiar pattern in which attackers turn remote management tools against you. CROSSROAD also stopped if the machine was in China or ran certain security agents.
The payload ran with the AOMEI process’s privileges. On the machines researchers examined, that was enough to install software across the whole system, though it depended on how the AOMEI service was configured. Background services run with whatever rights the application was given, and few organizations monitor what those services fetch.
The July 20 Change Needed No Code at All
During the July 20 window, the attackers also changed the notification file to open an invisible, one-pixel pop-up pointing to a file on an attacker’s server over WebDAV.
Simply rendering that pop-up can make Windows send NetNTLMv2 responses for the signed-in user to the attacker. That hashed credential can be cracked offline or reused. Because no program has to run, a machine that blocked the backdoor could still have leaked it.
A leaked credential from a standard user account gives an attacker limited reach, while one from an account with local admin rights opens far more doors. Keeping standing admin rights off everyday accounts lowers what this kind of leak is worth.
Why a Server Fix Doesn’t Clean Infected Machines
AOMEI told Mandiant on July 29 that it had taken corrective action. In a public statement updated October 30, the company attributes the activity to a group tracked as UNC7017 and says it moved its update service to a new server, disabled in-app promotional and automatic updates, and retired the affected download domain. It still hasn’t explained how the attacker gained access.
Backupper 8.5.1, released October 19, adds signature verification for the remote configuration files and separates software updates from marketing notifications. That closes the weakness behind this attack for anyone who upgrades, but the scheduled tasks and implants on infected machines stay put until someone finds and removes them.
Researchers say AnyViewer, AOMEI’s remote desktop tool, uses the same update flow, though AOMEI told The Record its monitoring found no abnormal activity there. Organizations running either product should assume exposure until they’ve checked.
What to Check Now
Researchers urge organizations to hunt across the entire April-to-July period, not just the confirmed windows. Practical steps include:
- Identifying every endpoint with AOMEI Backupper or AnyViewer installed, including copies users installed themselves
- Looking for scheduled tasks named RadminComponentRuntime or NitroRuntime
- Checking for an unsigned upgrade-now.exe carrying AOMEI’s publisher details, programs running from Backupper’s html pop-up folder, or unexpected files in a local Radmin app data folder
- Blocking the published attacker infrastructure, including storage-data[.]com and its subdomains, plus 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117
- Blocking outbound SMB (TCP 445) and WebDAV traffic to external addresses to stop the credential leak
- Running AOMEI’s free Security Scanner and upgrading any remaining installs to Backupper 8.5.1
- Resetting Windows or domain passwords for anyone who used an affected machine
When an alert fires, don’t validate it against the vendor’s download page. Preserve the files cached in the program’s own folders and check network logs for the exact time of the alert.
For organizations running Admin By Request EPM, the built-in inventory shows which endpoints have AOMEI software installed, and the audit log records installs that went through elevation, including who ran them and when. That speeds up the first step of the hunt.
Trusted Software Still Needs Oversight
Most organizations put real effort into controlling what users install and run, but far fewer look at what that software does on its own once it’s in place. As the AOMEI campaign shows, background update and notification channels give installed software a privileged path onto the endpoint that’s easy to overlook.
Short of signed updates from every vendor, the practical defenses are familiar: know which utilities are on your fleet, remove the ones nobody needs, and keep standing admin rights off everyday accounts so a leaked credential is worth less.
Our Endpoint Privilege Management solution routes software installs through logged, approval-ready elevation, so unvetted utilities don’t pile up unnoticed. Book a free demo or sign up for our lifetime free plan, with full features for up to 25 endpoints.
