Malware
AOMEI Backupper Update Servers Briefly Hijacked to Spread Backdoor Malware
Attackers tampered with AOMEI Backupper's update servers for minutes at a time, delivering a backdoor to Windows users who checked for updates during those windows, according to researchers.
Ross Grant4 min read
The short version
Attackers managed to briefly take control of the update servers for AOMEI Backupper, a Windows backup program. Anyone whose software checked for updates during these short periods could have received malware instead of a genuine update. The problem was fixed on the servers, but infected computers may still be at risk. Only one report has covered this so far, and the full scale is not yet known.
By the numbers
- 3confirmed attack windows (May 28, July 16, July 20, 2026)The Hacker News
- 11countries with affected organisations (including US, India, Australia)The Hacker News
What happened?
Attackers briefly changed files on AOMEI Backupper's update servers in several short windows between May and July 2026. During those times, any Windows user whose copy of the software checked for updates would have downloaded and run a backdoor. Researchers say AOMEI has fixed its servers, but infected machines remain at risk. Only one outlet has reported this so far.
What happened to AOMEI Backupper
Attackers were able to change files on the update servers used by AOMEI Backupper, a Windows backup tool, for short periods between May and July 2026. According to researchers at Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine, any copy of the software that checked for updates during these five-to-ten-minute windows would have downloaded and run a backdoor. The attack was first reported by The Hacker News (opens in a new tab).
AOMEI Backupper is made by AOMEI Technology, a Hong Kong-based vendor. The software regularly checks AOMEI's servers for updates and promotional messages. The attackers took advantage of this process by altering two text files that control what the program downloads and runs. No vulnerability in the software itself was exploited, and users did not need to take any action beyond having the program installed and running.
How the attack worked
The two files involved were down_html.ini (which names the update package and its checksum) and Notifycfg.ini (which controls pop-ups and what they run). The program does not cryptographically verify these files, and the checksum is not protected. By changing these files on the server, the attackers could make Backupper download and execute their own package.
When a machine checked for updates during a tampered window, it pulled down a downloader called CROSSROAD. This unpacked a bundle into a local folder, set up a scheduled task to run every three hours, and then deleted itself. The bundle included a signed copy of Radmin (a remote administration tool) and a custom DLL that loaded an implant called SHINYROAD. This implant gave the attackers remote control, letting them run commands and download more code. The implant only talked to one hard-coded address, so blocking that address could stop the attacker's control.
In one case, the attackers also used a trick involving a pop-up that made Windows send a user's authentication token to their server, just by rendering the pop-up. This could happen even if the main backdoor was blocked.
Who was affected and how
Google's telemetry identified affected organisations in IT services, telecoms, and higher education across 11 countries, including Australia, Brazil, India, and the US. Only machines that checked for updates during the attack windows were hit. The targeting was described as opportunistic: the attackers did not pick specific victims but hit whoever happened to connect at the right time.
The researchers confirmed three tampering windows:
- May 28, 2026: 10 minutes
- July 16, 2026: 6 minutes
- July 20, 2026: 5 minutes
They believe there may have been more. The exact number of affected users is not known.
What has AOMEI done?
AOMEI was notified by ManageEngine on June 7 and by Mandiant on July 17. The company told Mandiant on July 29 that it had taken action to secure its servers. However, as of publication, researchers had not independently confirmed that the compromise was fully contained. The vendor's changelog does not mention any change to how updates are verified.
Fixing the servers does not clean infected machines. The downloader restored the local update file to its genuine contents after installing the backdoor, so infected systems may appear normal. Both GTIG and ManageEngine urge organisations using AOMEI software to check their systems for signs of compromise from April to July 2026.
What users and defenders should do
Anyone running AOMEI Backupper should check for signs of the CROSSROAD downloader, the SHINYROAD implant, and scheduled tasks that run Radmin. Blocking the single command-and-control address used by the implant can cut off the attacker's access. Organisations should also review their update processes and consider monitoring for unexpected scheduled tasks or remote administration tools.
What is still unclear
It is not known how the attackers gained access to change files on AOMEI's servers. There is no information on which versions of Backupper are affected, and it is not clear if the update process has been made more secure in the latest releases. The total number of affected users has not been published.
Claimed vs confirmed
- Confirmed
AOMEI's update servers were tampered with to deliver a backdoor.
GTIG, Mandiant, and ManageEngine all reported the tampering and delivery of malware via the update servers.
- Confirmed
AOMEI has secured its servers after the attack.
AOMEI told Mandiant on July 29 that corrective action had been taken.
- Unconfirmed
The compromise has been fully contained.
ManageEngine said it had not independently confirmed that the compromise was contained as of publication.
The impact
- Money
- There is no information on direct financial losses. However, under data protection laws, companies could face fines if customer data was compromised. The maximum fine under UK GDPR is £17.5m or 4% of global turnover.
- Reputation
- AOMEI's reputation may be affected, especially among IT and enterprise customers who rely on its backup software. The incident raises questions about its update security.
- Customers
- Users who checked for updates during the attack windows may have unknowingly installed malware. They should check their systems for signs of compromise and monitor for unusual activity.
Why it matters
This incident shows how attackers can use trusted software updates to deliver malware, even without exploiting a vulnerability. Organisations using AOMEI Backupper may have unknowingly installed a backdoor if their systems checked for updates at the wrong time. The attack highlights the risks of insecure update mechanisms and the importance of verifying software updates.
How does it work?
The attackers altered two text files on AOMEI's update servers. These files told the software which update package to download and run, but were not cryptographically verified. If a machine checked for updates during a tampered window, it would download and run a backdoor without user action. In one case, a pop-up could also leak a user's authentication token just by being displayed.
Key points
- Attackers tampered with AOMEI Backupper's update servers for minutes at a time.
- Only users who checked for updates during those windows were affected.
- The attack did not exploit a vulnerability; it abused insecure update design.
- AOMEI says its servers are fixed, but infected machines may still be compromised.
- The full scale and exact versions affected are not yet known.
Sources
The Hacker News
Reference
