Attackers pushed a backdoor through AOMEI Backupper's update servers in windows of 5 to 10 minutes
Attackers altered files on AOMEI's update servers in windows of five to ten minutes between May and July 2026 to push a backdoor to Backupper installs. AOMEI has reported fixing its servers, but the researchers say that does not remove the backdoor from machines already hit.
The Watch · Security desk
Key figures: the three tampering windows GTIG and Mandiant confirmed total 21 minutes. The first and last confirmed windows are 53 days apart. Three windows were confirmed, on May 28, July 16 and July 20, 2026.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Three confirmed tampering windows, combined | 21 minutes | 19 | |
| First to last window | 53 days apart | 20 | |
| Tampering windows confirmed | 3 windows | 5 |
What happened
- Backupper does not cryptographically verify either update file, and the checksum meant to prove a download is genuine sits inside the same unsigned file that names the package.
- GTIG and Mandiant confirmed three windows: May 28 for 10 minutes, July 16 for 6 minutes and July 20 for 5 minutes, all in UTC morning hours.
- GTIG's telemetry shows affected IT services, telecommunications and higher-education organizations in 11 countries; it gave no total and said the real number is likely higher.
- On a machine that pulled the package, a downloader GTIG calls CROSSROAD unpacked a bundle into a Radmin folder, created a task set to run every three hours, and deleted itself.
- ManageEngine's lab said no software flaw was exploited and users did not have to do anything; a machine only needed the program installed and running.
Why it matters
- Who's exposed exposure The three dates are a minimum. GTIG and Mandiant said more windows probably happened that they did not see, so checking an install against May 28, July 16 and July 20 alone proves little.
- What it limits constraint The server fix does nothing for hosts that already ran the package. Their scheduled task keeps firing every three hours, and the downloader that created it has already deleted itself, so there is no installer to hunt.
- Who has to decide decision The implant talks to one hard-coded address with no backup, so a block on that address cuts off the attacker's control. The scheduled task and implant stay on the host until someone removes them.
Confirmed tampering adds up to 21 minutes [19], spread over the 53 days between the first and last confirmed windows [20]. Google Threat Intelligence Group (GTIG) said it is the first supply chain compromise it has encountered built on windows this short, "effectively evading traditional point-in-time triage and automated file scanning." [11]
The account comes from GTIG, Mandiant and ManageEngine's Threat Analysis Lab, as relayed by The Hacker News [1]. GTIG described the targeting as opportunistic. It hit whatever system polled during those minutes [7].
The package inherited the privileges of whichever AOMEI process started it [4]. On the lab's test machines, those privileges were sufficient for system-wide software installation, though the lab said that level of access hinged on the way the AOMEI service ran [4].
The scheduled task runs a signed copy of Radmin, which loads an attacker-built DLL placed beside it, and that DLL loads the SHINYROAD implant [14]. Radmin itself is a decoy for the defender. ManageEngine's lab found Radmin put in place but left dormant: no listener running, no configuration applied, no account added [13]. Control comes from the implant, which gives a remote shell and can fetch and run new code on command [17].
The downloader does not run everywhere. CROSSROAD stops if the machine is in China [15]. According to ManageEngine, it also halts when certain security agents are present on the host [15]. Where a machine cleared both checks, GTIG later observed a second tool delivered on top of SHINYROAD [16].
GTIG tracks the group as UNC7017 and has not linked it to a country or known actor [10]. The affected Backupper versions appear in neither report; the lab's analysis covered version 8.3.0 [9]. GTIG said AnyViewer, AOMEI's remote-desktop tool, shares the same update flow, though the detections in its account involve Backupper [9].
What to watch
- Whether AOMEI or the researchers publish the affected Backupper versions, since the lab tested only 8.3.0.
- Whether GTIG, Mandiant or ManageEngine report tampering windows beyond May 28, July 16 and July 20.
- Whether AOMEI changes the client to verify the two update files.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption30
- Hype gap−10
- Incentives
- Not scored
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab disclosed the campaign this week and say AOMEI has reported fixing its servers, but that fix does not remove the backdoor from machines already hit.
- [2]
The program does not cryptographically verify either update file, and the checksum that is supposed to prove the download is genuine sits inside the same unsigned file that names it.
- [3]
Nothing in the software was exploited. There was no vulnerability, and no user action was needed beyond having the program installed and running, according to ManageEngine's lab.
- [4]
The attacker's package ran with the privileges of the AOMEI process that launched it. On the machines the lab examined, that was enough to install software across the whole system, though the lab said the elevation depended on how the AOMEI service was running.
- [5]
GTIG and Mandiant confirmed three tampering windows: May 28, 2026, 10 minutes, 05:40 to 05:50 UTC; July 16, 2026, 6 minutes, 08:33 to 08:39 UTC; and July 20, 2026, 5 minutes, 10:35 to 10:40 UTC.
- [6]
GTIG and Mandiant said more tampering windows probably happened that they did not see.
- [7]
Only copies that checked for an update during a window were affected; a copy that checked before or after got clean, genuine files. GTIG described the targeting as opportunistic, hitting whatever system happened to poll during those minutes.
- [8]
From its own telemetry, GTIG identified affected organizations in IT services, telecommunications and higher education across 11 countries. It gave no total and said the real number is likely higher.
- [9]
Neither report lists which Backupper versions are affected, and the lab examined version 8.3.0. GTIG named AnyViewer, AOMEI's remote-desktop tool, as using the same update flow, but the detections it describes involve Backupper.
- [10]
GTIG tracks the group behind the campaign as UNC7017 and names no country or known actor.
- [11]
GTIG said this is the first supply chain compromise it has encountered built on Windows this short, "effectively evading traditional point-in-time triage and automated file scanning."
- [12]
On a machine that pulled the package, a downloader that GTIG calls CROSSROAD unpacked a bundle into a local Radmin folder, created a scheduled task set to run every three hours, and then deleted itself from disk.
- [13]
The bundle included a genuine, signed copy of Radmin; ManageEngine's lab found it staged but never switched on, with no listener, no configuration, and no new account.
- [14]
The scheduled task runs the signed Radmin program, which loads an attacker-built DLL placed beside it, which in turn loads the SHINYROAD implant.
- [15]
CROSSROAD checks the machine's location and stops if it is in China; ManageEngine added that it also stops if it finds particular security agents on the host.
- [16]
On machines that passed those checks, GTIG later saw a second tool pushed down on top of SHINYROAD.
- [17]
The SHINYROAD implant gives a remote shell and can fetch and run new code on command.
- [18]
The implant talks to a single hard-coded address with no backup, so blocking that one address cuts off the attacker's control.
- [19]
The three confirmed windows total 21 minutes.
- [20]
The first and last confirmed windows are 53 days apart.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comAttackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Software Supply Chain AttacksFollow
- Update mechanism securityFollow
- Backdoors and implantsFollow