● Covered by 3 sources · 3 reportsMedium impact2 negative1 neutral
AOMEI Backupper Update Servers Briefly Compromised to Deliver Backdoor
Key points
- AOMEI Backupper update servers were compromised.
- Attackers delivered a backdoor for minutes at a time.
- Affected systems downloaded and ran malicious code.
- Fixes implemented, but existing backdoors remain.
- AOMEI's update and notification servers were compromised.
- Attackers used a built-in promotional feature in AOMEI Backupper.
- Attacks occurred between April and July 2026.
- ManageEngine's Threat Analysis Lab, Google's Threat Intelligence Group, and Mandiant uncovered the campaign.
- Threat actor UNC7017 is attributed to the activity.
- CROSSROAD downloader and SHINYROAD backdoor were distributed.
- Affected organizations are in the US, Australia, India, Singapore, Spain, and Switzerland.
- Affected sectors include IT services, telecommunications, and higher education.
- AOMEI Backupper is Windows backup, sync, and disk cloning software.
- AOMEI products are used by over 186 million people globally.
- Affected organizations are in Brazil, Pakistan, Portugal, and South Africa.
Update Server Tampering Incident
Attackers repeatedly altered files on AOMEI Backupper's update servers for brief intervals, typically five to ten minutes, between May and July 2026. During these windows, any AOMEI Backupper installation checking for updates would download and execute a backdoor instead of legitimate software updates.
Discovery and Disclosure
Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine's Threat Analysis Lab disclosed this campaign. AOMEI has reportedly fixed its servers, but this action does not remove backdoors from machines already infected. The attack did not exploit a software vulnerability; instead, it manipulated the update mechanism by changing two text files on the server.
Mechanism of Attack
AOMEI Backupper, a Windows backup and disk-cloning tool, regularly checks AOMEI's servers for updates and promotional content. The program uses `down_html.ini` to name the update package and its checksum, and `Notifycfg.ini` for pop-up content. The software does not cryptographically verify these files, and the checksum is located within the same unsigned file it is meant to verify. This allowed attackers to replace legitimate files with malicious ones, which were then executed with the privileges of the AOMEI process.
Impact and Affected Systems
Systems that checked for updates during the compromise windows were affected. GTIG and Mandiant confirmed three specific tampering windows: May 28, 2026 (10 minutes), July 16, 2026 (6 minutes), and July 20, 2026 (5 minutes). The targeting was opportunistic, affecting any system that polled the server during these brief periods. The backdoor installation could lead to system-wide software installation, depending on the AOMEI service's running privileges.
Updates
- AOMEI Backupper is Windows backup, sync, and disk cloning software.
- AOMEI products are used by over 186 million people globally.
- Affected organizations are in Brazil, Pakistan, Portugal, and South Africa.
- AOMEI's update and notification servers were compromised.
- Attackers used a built-in promotional feature in AOMEI Backupper.
- Attacks occurred between April and July 2026.
- ManageEngine's Threat Analysis Lab, Google's Threat Intelligence Group, and Mandiant uncovered the campaign.
- Threat actor UNC7017 is attributed to the activity.
- CROSSROAD downloader and SHINYROAD backdoor were distributed.
- Affected organizations are in the US, Australia, India, Singapore, Spain, and Switzerland.
- Affected sectors include IT services, telecommunications, and higher education.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
AOMEI Backupper, a Windows backup software, served malware to users between April and July through short-duration supply chain compromises. Attackers tampered with update servers for 5-10 minute windows, distributing the CrossRoad downloader and ShinyRoad backdoor, affecting users who updated during these periods.
Hackers compromised AOMEI's update and notification servers between April and July 2026, using a built-in promotional feature in AOMEI Backupper to distribute new malware. The attackers briefly modified configuration files to deliver CROSSROAD downloader and SHINYROAD backdoor, impacting organizations in multiple countries and sectors.
Attackers tampered with AOMEI Backupper's update servers for short periods between May and July 2026, causing the Windows backup software to download and execute a backdoor. The compromise allowed the installation of malicious software on systems that checked for updates during these brief windows, affecting users without requiring any specific action beyond having the program installed.