AOMEI Backupper update servers briefly hijacked to push a backdoor
Original title: AOMEI Backupper servers hijacked for minutes at a time to push backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
Between April and July 2026, attackers altered AOMEI Backupper update and pop-up configuration files on the vendor’s servers for five to ten minutes at a time, then restored them. Copies of version 8.3.0 and later that checked in during confirmed windows on May 28, July 16, and July 20 downloaded a dropper, CROSSROAD, which installed genuine Radmin Server and the SHINYROAD backdoor. Google tracks the operators as UNC7017. How they reached the servers is undisclosed; AOMEI said on July 29 it had taken corrective action.
Unconfirmed: Server access is undisclosed, AOMEI initially found no breach evidence, and the victim set is likely broader than confirmed cases.
- Confirmed tampering windows were May 28, July 16, and July 20.
- The dropper skipped China, unknown locations, and some security products.
- The July 20 pop-up forced WebDAV logons that leaked NetNTLMv2 hashes.
- Confirmed victims include IT, telecom, and higher education in 11 countries.
- AOMEI AnyViewer uses the same update path and was also targeted.
Impact: Backdoor and remote admin tool; some NetNTLMv2 hashes leaked
| Product | Affected |
|---|---|
| AOMEI Backupper | 8.3.0 and later |
| AOMEI AnyViewer | — |
- 1.Check ManageEngine and Google indicators of compromise for AOMEI Backupper.
- 2.Investigate and respond if a host checked in during a tampering window.
- 3.Check AOMEI AnyViewer installs that use the same update mechanism.
- Vendors
- AOMEI
- Threat actors
- UNC7017
- Organizations
- ManageEngineGoogle Threat Intelligence GroupMandiant
From the original article
4 min read at helpnetsecurity.com
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.