Three brief windows — May 28, July 16 and July 20, 2026 — each lasting between five and ten minutes, were all an attacker needed to replace files on AOMEI's update servers and deliver a functioning backdoor to any running copy of AOMEI Backupper that checked for updates during those minutes.
How AOMEI's update flow allowed the attack
AOMEI Backupper and the company's remote‑desktop product AnyViewer use background services that poll AOMEI's own servers over HTTPS for update instructions and promotional pop‑ups. Two text files control that flow: down_html.ini, which names the update package and supplies the checksum, and Notifycfg.ini, which tells the pop‑up service what to display and what to run.
Neither file is cryptographically signed, and the checksum that is supposed to validate the download sits inside the same unsigned file that names it. ManageEngine's Threat Analysis Lab concluded nothing in the software was exploited and no user action was required beyond having the program installed and running; an attacker only had to change those two files on the vendor's servers for a few minutes to make a client download and execute an attacker package.
What landed on infected machines: CROSSROAD, signed Radmin, SHINYROAD and Adaptix
When a Backupper client polled during a tampering window, it downloaded the attacker's package into its local folder and the notification file caused it to be executed with the privileges of the AOMEI process. In the examined cases, the initial downloader — tracked by Google Threat Intelligence Group (GTIG) as CROSSROAD — unpacked a bundle into a local Radmin folder, created a scheduled task to run every three hours, and deleted itself from disk.
The bundle included a genuine, signed copy of Radmin, a commercial remote‑administration tool. ManageEngine's lab found that signed binary staged beside an attacker‑built DLL that the signed loader would in turn load; that DLL then loaded the SHINYROAD implant. SHINYROAD provided a remote shell and could fetch and run additional code on command.
GTIG observed that on some hosts a second tool, the open‑source Adaptix C2 framework disguised as Nitro PDF, was pushed on top of SHINYROAD. CROSSROAD performs environment checks: it stops if the host appears to be in China and also stops if it finds particular security agents on the host. The SHINYROAD implant talks to a single hard‑coded address with no backup, meaning blocking that address severs the attacker’s control channel.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThree brief tampering windows and at least eleven countries affected
GTIG and Mandiant confirmed three tampering windows (GTIG listed them as):
- May 28, 2026 — 05:40 to 05:50 UTC (10 minutes)
- July 16, 2026 — 08:33 to 08:39 UTC (6 minutes)
- July 20, 2026 — 10:35 to 10:40 UTC (5 minutes)
GTIG described the targeting as opportunistic: any copy of Backupper that polled during those minutes would be affected, while copies that polled before or after would get genuine files. From its telemetry, GTIG identified impacted organizations in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. GTIG said the real number is likely higher.
A second trick on July 20: silent WebDAV pop‑up that leaks credentials
The July 20 window included a change to the notification file that required no program execution. The altered Notifycfg.ini opened an invisible, one‑pixel pop‑up that pointed to a file on an attacker server via WebDAV. Rendering that pop‑up can cause Windows to send the logged‑in user's NetNTLMv2 authentication response to the attacker's address — a token that attackers can attempt to crack offline or reuse — with nothing visible to the user. Because no program had to run, a backdoor that was otherwise blocked would not prevent that credential leakage.
What to check now for defenders, procurement leaders, and affected organizations
GTIG and Mandiant warned that vendor‑side fixes do not clean already‑infected machines. ManageEngine said its endpoint telemetry first caught the activity on May 28, a customer raised it on June 7, and that it notified AOMEI the same day. Mandiant notified AOMEI on July 17 and AOMEI told Mandiant on July 29 that it had taken corrective action to secure its servers. ManageEngine said it had not independently confirmed containment as of its publication.
Both GTIG and ManageEngine published advice for hunts and containment. Preserve cached copies of the files in the program’s own folders and check network logs for what was served at the exact time an alert fired; the vendor's download page will usually show genuine content because the attacker’s changes lasted only minutes and the malicious packages were replaced.
- Endpoint indicators to hunt: scheduled tasks named RadminComponentRuntime or NitroRuntime; an unsigned upgrade‑now.exe that carries AOMEI publisher details; any program running from Backupper's HTML pop‑up folder; attacker files staged under the local Radmin application‑data folder.
- Network actions: block the attacker infrastructure named in both reports and block outbound SMB (TCP 445) and WebDAV to external addresses. The reports list these domains and IPs to block: storage-data[.]com, promotion.storage-data[.]com, aomei.storage-data[.]com; IPs 8.210.84[.]56, 8.218.65[.]184, 47.239.60[.]117.
- Detection resources: GTIG published YARA rules and ManageEngine published Sigma rules; both sets are the researchers' own.
Two final, stark facts underline the operational risk: the attacker needed only to change two unsigned text files on AOMEI's servers for a few minutes, and a server‑side correction does not remove implants already scheduled to run on compromised hosts. AOMEI's published changelog checked on October 16 lists no change to how Backupper verifies updates in the current release, 8.5.0 (dated October 9), and neither report points to a Backupper version that would close the gap. Organizations that used Backupper from April through July 2026 therefore face an exercise in verification and cleanup, not a simple trust‑but‑recheck of the vendor's download page.
