AOMEI Backupper update servers briefly tampered with to push SHINYROAD backdoor

Attackers repeatedly tampered with the update files that AOMEI Backupper downloads from AOMEI's own servers, delivering a backdoor to any installation that happened to check for updates during windows lasting only a few minutes, according to research published on October 16, 2026 by Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine's Threat Analysis Lab, as reported by The Hacker News. Affected organizations were found in 11 countries, including Türkiye.

What happened

According to the report, AOMEI Backupper fetches two configuration files over HTTPS: down_html.ini, which names the update package and its checksum, and Notifycfg.ini, which controls pop-up content and what gets executed. Neither file is cryptographically signed, and the checksum sits in the same unsigned file, so it offers no real protection. No software vulnerability was exploited.

The Hacker News lists three tampering windows (UTC): May 28, 2026 (05:40–05:50), July 16 (08:33–08:39) and July 20 (10:35–10:40). ManageEngine's endpoint software first flagged AOMEI Backupper installing Radmin on two unrelated customers on May 28 and notified AOMEI on June 7. Mandiant contacted AOMEI on July 17, and the vendor said on July 29 that it had taken corrective action on its servers. AOMEI initially blamed in-transit interception, a claim the researchers said the evidence contradicted. ManageEngine said it had not independently confirmed that the compromise was contained.

Technical details

The malicious update installed a downloader dubbed CROSSROAD, which unpacked a genuine, signed copy of Radmin and created a scheduled task running every three hours. That task launched Radmin, which loaded an attacker-built DLL carrying the SHINYROAD implant, providing a remote shell and the ability to run new code. CROSSROAD reportedly stops on machines located in China. On some systems GTIG saw the open-source Adaptix C2 framework deployed afterwards, disguised as Nitro PDF software. In the July 20 window, the notification file was also changed to open an invisible pop-up pointing to an attacker-controlled WebDAV share, which could leak users' NetNTLMv2 authentication responses.

GTIG tracks the actor as UNC7017 and describes the targeting as opportunistic, with victims in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the US. GTIG adds that AOMEI's AnyViewer remote desktop tool uses the same update flow.

What to do

Researchers warn that organizations cannot assume they are safe because the vendor fixed its servers. Recommended steps include:

• Hunt for compromise across the full April–July 2026 period, since the downloader restored the genuine update file after installing persistence.
• Look for scheduled tasks named RadminComponentRuntime or NitroRuntime, an unsigned upgrade-now.exe with AOMEI publisher details, and unexpected files in the local Radmin application-data folder.
• Block the domains storage-data[.]com, promotion.storage-data[.]com and aomei.storage-data[.]com, and the IPs 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117.
• Block outbound SMB (TCP 445) and WebDAV to external addresses.
• Do not validate alerts against the vendor's download page, which usually serves clean files; preserve cached files and network logs instead, and test the YARA and Sigma rules published by GTIG and ManageEngine.