AOMEI Backupper Backdoor Hit Windows Users Through Tampered Updates

Attackers secretly tampered with the update servers for AOMEI Backupper, a Windows backup and disk-cloning program, and turned routine update checks into a backdoor. The changes ran in short bursts between May and July 2026 and reached systems in 11 countries, including the United States. Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab published their findings on October 16, and the most important warning is simple: the vendor's server fix does not clean machines that were already infected.

AOMEI Backupper is made by AOMEI Technology, a vendor registered in Hong Kong. Its background services regularly check AOMEI's servers for updates and promotional pop-ups, according to InfoSec Today. The attackers did not break the program. They abused the update check it already makes.

What the AOMEI Backupper backdoor changed in update checks

The attackers altered the update files that AOMEI Backupper downloads from the vendor's own servers, and they did it for only five to 10 minutes at a time. Only computers that checked for updates during those minutes received the malicious package, according to The Hacker News. Google describes the targeting as opportunistic, meaning the campaign hit whatever systems happened to poll during the windows.

That design makes this a supply-chain attack. Victims received the malware through software they chose to install and trust, which makes it hard for standard scanning to flag. The same research, republished by Simply Secure Group, notes that the attacker never needed to break the software itself.

Google's telemetry identified affected organizations in IT services, telecommunications and higher education across 11 countries, including the United States. Google did not give a total and said the true number is likely higher than what it observed. The gap matters, because a small count in telemetry can still mean many machines on the ground.

The joint statement from Google Threat Intelligence Group and Mandiant put the core problem plainly: "Organizations running AOMEI software cannot assume they are protected solely because the vendor took corrective server-side action." No individual was named in the statement.

Three tampering windows and one hard-coded address

Researchers confirmed three windows in which the update files were swapped. They said more likely occurred that they did not observe.

The short length does not reduce the cleanup work. A machine that polled during a five-minute window is as exposed as one that polled during a ten-minute window. The researchers recommend hunting across April through July 2026, a much wider net than the three confirmed windows.

How the malware chain worked on infected PCs

The first stage was a downloader that Google calls CROSSROAD. It unpacked a bundle into a local folder, created a scheduled task that runs every three hours, and then deleted itself. The bundle included a genuine, signed copy of the commercial Radmin remote-administration tool. Radmin then loaded an attacker-built DLL, and that DLL loaded the SHINYROAD implant.

SHINYROAD provides a remote shell and can fetch and run new code. It communicates with one hard-coded address, so blocking that address cuts off the attacker's control. On some machines, a second tool was added on top: the open-source Adaptix C2 framework, disguised as Nitro PDF software.

The downloader also checks the machine's location and stops if it sits in China. It stops if particular security products are present, too. The reports do not explain the reasoning, but the checks suggest the operators wanted to avoid certain environments while staying quiet in others.

The weak point sits in the update design. The program does not cryptographically verify its update files. The checksum it uses sits inside the same unsigned file that names the download, so a swapped file looks legitimate to the software. Any update system that asks a file to vouch for itself has this flaw, and a real signature check is the missing control.

Which AOMEI Backupper versions are affected

The reports do not say which Backupper versions are affected. ManageEngine's lab examined AOMEI Backupper 8.3.0, but one build does not establish a range. Readers should not assume newer releases are safe or older ones are vulnerable until AOMEI publishes a version list or the researchers name one.

The vendor's sister product, the remote-desktop tool AnyViewer, reportedly uses the same update flow. The detections described involve Backupper, and the reports do not confirm that AnyViewer was tampered with. Anyone running AnyViewer should include it in the same review rather than assume it is clean.

According to ManageEngine's lab, the attack required no user action beyond having the program installed and running. No software vulnerability was exploited. The risk came from trusting the update channel itself.

Why the vendor's fix does not clean infected PCs

The timeline runs for months. ManageEngine's endpoint software first flagged the activity on May 28, when it recorded AOMEI Backupper installing Radmin at two unrelated customers in different countries. A customer raised it on June 7, and the lab notified AOMEI that same day. Mandiant notified AOMEI on July 17 and shared indicators. AOMEI told Mandiant on July 29 that it had taken corrective action on its servers.

AOMEI's first explanation was that the content had been intercepted and altered in transit. The ManageEngine lab said the evidence did not support that account. The lab also said it had not independently confirmed that the activity was contained as of publication.

That gap is the heart of the problem. A server fix changes what the next download contains, but it does not reach into a machine that already runs SHINYROAD. The downloader also restored the local update file to its genuine contents, so an infected PC can look normal afterward. The vendor's download page looks clean too, so reinstalling from it does not prove a machine is safe.

ManageEngine's lab described the technique as "effectively evading traditional point-in-time triage and automated file scanning," which explains why a single scan may come back clean. The closest comparison is the 2013 Target breach, which also reached a retailer through a third-party pathway, although the mechanism was different. This campaign resembles earlier software-update compromises that were discovered after the fact. It surfaced roughly four and a half months after the first confirmed window.

Our coverage of China-linked Armory Castle, which exploited a BeyondTrust zero-day for seven weeks, shows how long a quiet foothold can last. The AOMEI reports make no such link. Google tracks this actor as UNC7017 and does not name a country or known actor.

How to check for the AOMEI Backupper backdoor

• Inventory first. Find every Windows machine running AOMEI Backupper and record its version. Add any machine running AnyViewer to the same list.
• Hunt April through July 2026. Search endpoint, EDR or event logs across that period for a scheduled task named RadminComponentRuntime or NitroRuntime, an unsigned file named upgrade-now.exe that carries AOMEI's publisher details, programs running from Backupper's HTML pop-up folder, and attacker files in the local Radmin application-data folder.
• Look for recurring execution. Because the scheduled task runs every three hours, a suspicious task that fires repeatedly in logs is a stronger signal than a single entry.
• Block the command address. Get the single hard-coded address from the researchers' original reports, which contain the full indicator list, and block it at the firewall, DNS or proxy.
• Treat any hit as compromised. Isolate the machine, rebuild or reimage it rather than relying on a patch, and reset credentials that were used on it. This is our recommendation, not a step the researchers listed.

For a parallel case, our guide to the BeyondTrust zero-day makes the same argument for patching and then rebuilding: Patch Now, Then Rebuild. Home users without IT support should either check for these artifacts or hire a security professional to do it. Until someone can verify the machine, removing the program is the safer choice in our view.

What to watch next

Several open questions will decide how serious this becomes. The reports do not list affected Backupper builds, and the total victim count remains unknown. Google's group has not attributed the activity beyond UNC7017, so the attacker's identity, country and motive are unconfirmed.

Watch for four things: a published list of affected versions, a signature-verification update from AOMEI, the names of affected US organizations, and confirmation that AnyViewer's update flow is clean. The real test is whether the vendor's fix holds up under independent checks, which ManageEngine said it had not yet confirmed.