AOMEI Backupper Update Servers Tampered to Push a Backdoor: What IT Teams Should Do Now

This is a software supply chain attack, not a bug in the backup program. The client trusted unsigned remote files, so whoever could edit them on the vendor's servers could decide what ran on customer PCs. That makes it a lesson for every team that lets endpoint software auto-update.

Below is what is confirmed, what is still disputed, and a checklist for IT teams. For the underlying practices, see the NIST guidance on cybersecurity supply chain risk management (SP 800-161 Rev. 1) and the NIST Secure Software Development Framework (SP 800-218).

What Happened

Google's Threat Intelligence Group (GTIG) with Mandiant, and ManageEngine's Threat Analysis Lab, reported that attackers briefly altered update files on the servers of the Windows backup vendor AOMEI to deliver malware to customer PCs. The Hacker News and ManageEngine published on October 16, 2026.

BleepingComputer followed on October 19. The vendor is AOMEI, based in Hong Kong, and the product is AOMEI Backupper.

• Activity ran from April to July 2026. ManageEngine first saw it on May 28, when its endpoint tooling recorded Backupper installing the Radmin remote administration tool at two unrelated customers.
• The attackers edited down_html.ini, which names the update package and its checksum, and Notifycfg.ini, which controls the pop-up content. The edits lasted minutes, then the files were restored.
• Reported windows were about 10 minutes on May 28, 6 minutes on July 16 and 5 minutes on July 20, according to The Hacker News and BleepingComputer.
• Google tracks the actor as UNC7017 and names two tools: the CROSSROAD downloader and the SHINYROAD backdoor.

How the Attack Worked

The client downloaded a promotional package named in an unsigned file and trusted the checksum in that same file. By changing both, the attacker made a malicious archive look valid. No vulnerability in the Backupper code was exploited, according to ManageEngine's research post.

The notification file then pointed a pop-up at a local page that launched an unsigned executable carrying AOMEI publisher details. The dropper checked the environment, installed the genuine, signed Radmin Server, and created a scheduled task that ran every three hours. An attacker-built DLL loaded beside a Radmin component and connected out to a hard-coded command server.

A July 20 variant also tried to force outbound SMB or WebDAV connections, which could expose NetNTLMv2 authentication material without running code on the machine.

Who Is Affected

Only machines that checked for updates during a tampering window received malicious content. GTIG identified victims in IT services, telecommunications and higher education, and said more tampering likely occurred that it did not observe.

• Reports name victims in the United States, Australia, India, Singapore, Spain and Switzerland; The Hacker News lists 11 countries in total.
• ManageEngine observed Backupper version 8.3.0 and later. Neither report lists every affected version.
• GTIG says AOMEI AnyViewer uses the same update flow, although its detections involve Backupper.
• Details differ between outlets, so treat counts and version ranges as provisional.

What AOMEI Has Said

AOMEI first suggested the content was altered in transit, which the researchers disputed. It later told Google it had taken corrective action on its servers. Neither report explains how the attacker gained write access, and ManageEngine had not independently confirmed that the compromise was contained.

The Hacker News reports that Backupper 8.5.0 shipped on October 9, but as of October 16 the changelog showed no change to update verification. A server fix stops new infections. It does not clean machines that already ran the payload.

Why It Matters for B2B SaaS Buyers and IT Teams

Backup and imaging tools run with high privilege and often sit on servers and admin workstations. A compromised update path gives an attacker the same trust as the vendor, which makes update integrity a buying criterion alongside features and price.

• Ask vendors whether update manifests and packages are cryptographically signed and verified by the client.
• Prefer tools managed through a central console, so updates can be staged and approved rather than pulled by each PC.
• Check vendor incident-response commitments and how quickly they notify customers.
• Keep consumer-grade utilities off servers when an enterprise-managed alternative exists.

What to Do Now

Treat any host that ran AOMEI Backupper or AnyViewer in April through July 2026 as a hunting target. Researchers stress that a clean download page proves nothing, because the files were restored within minutes of each window.

• Search endpoint telemetry for the RadminComponentRuntime scheduled task, a Radmin install nobody configured, and unsigned executables run from the Backupper pop-up folder.
• Block the published indicators, including storage-data[.]com subdomains and the IP addresses listed by The Hacker News.
• Block outbound SMB (TCP 445) and WebDAV to external addresses to limit credential capture.
• Rotate credentials for accounts used on suspect machines, since NTLM material may have been exposed.
• Check whether your EDR policies ran in audit-only mode; affected environments logged the activity but did not block it.
• Pause automatic updates for the product until the vendor documents signature verification.

Longer term, review how your backup and recovery tools and wider backup and archiving software verify updates. Compare managed options such as Acronis Cyber Protect, Veeam Backup & Replication and NAKIVO Backup & Replication on that criterion. Our earlier coverage of the ConnectWise Cloud Backup incident shows the same lesson: trust in a vendor channel is an attack surface.

Frequently Asked Questions

How do I know if my systems were hit by the AOMEI Backupper compromise?
Hunt across April to July 2026 for the RadminComponentRuntime scheduled task, an unconfigured Radmin install, unsigned executables launched from Backupper's pop-up folder, and traffic to the published domains and IPs. A clean vendor download page is not proof, because files were restored within minutes.

Does updating to the latest AOMEI Backupper version fix the problem?
Not by itself. The server-side fix stops new tampering but does not remove a backdoor already installed. As of October 16, 2026, reports say the changelog showed no change to update verification, so also isolate and rebuild suspect hosts and rotate credentials.

What should we ask backup vendors about update security?
Ask whether manifests and packages are signed and verified by the client, whether updates can be staged through a central console, how the vendor monitors its distribution servers, and how fast it notifies customers after an incident.