Hackers Hijack AOMEI Update Servers to Secretly Spread Malware

Attackers Briefly Hijacked AOMEI's Update Infrastructure to Push Backdoors

Threat actors compromised the update servers behind AOMEI Backupper, a Windows backup and disk-cloning tool used by more than 100 million people worldwide, abusing a built-in promotional/notification feature to distribute malware during short tampering windows lasting as little as five to ten minutes at a time. The campaign, which researchers place between April and July 2026, also touched AnyViewer, AOMEI's remote desktop product, since it shares the same distribution infrastructure. Mandiant tracks the activity as UNC7017, and the custom malware deployed — a downloader called CROSSROAD and a backdoor named SHINYROAD — was first spotted on May 28, 2026 when ManageEngine's endpoint security software flagged AOMEI Backupper installing the legitimate remote-administration tool Radmin on machines at two unrelated companies in different countries.

Incident Details

Attribute	Value
Vendor	AOMEI Technology
Products affected	AOMEI Backupper (primary), AnyViewer (shared infrastructure)
Attack type	Supply chain / update-server compromise
Threat actor	UNC7017 (per Mandiant)
Malware deployed	CROSSROAD (downloader), SHINYROAD (backdoor)
Initial payload	`upgrade-now.exe`
Campaign window	April – July 2026
Confirmed tampering windows	~10 min (May 28), ~6 min (July 16), ~5 min (July 20)
Vulnerability exploited	None identified — relied on tampered config files, not a software flaw
Victim sectors	IT services, telecommunications, higher education
Victim countries	11, including the US, Australia, India, Brazil, Spain, Switzerland, Singapore
Researchers	ManageEngine Threat Analysis Lab (METAL), Google Threat Intelligence Group (GTIG), Mandiant
AOMEI remediation confirmed	July 29, 2026
CVE assigned	None

How It Worked

Abusing a promotional feature, not a software bug

Rather than exploiting a vulnerability in AOMEI Backupper itself, the attackers went after the server side of a feature most users never think about: the in-app promotional and notification system that periodically checks AOMEI's servers for content to display. That system reads two configuration files — down_html.ini and Notifycfg.ini — which normally point the client to benign promotional material. The attackers gained the ability to edit these files directly on AOMEI's infrastructure.

Minutes-long tampering windows

During each attack window, the threat actor swapped the legitimate down_html.ini entry for one pointing to a malicious ZIP archive, and altered the accompanying version number and MD5 checksum so the client's integrity check would accept the tampered file as legitimate. Because the changes were reverted within five to ten minutes, only clients that happened to check in during that narrow interval received the malicious update — researchers confirmed at least three such windows (May 28, July 16, and July 20, 2026) but noted more may have occurred undetected.

CROSSROAD and SHINYROAD

The initial payload, delivered as an unsigned upgrade-now.exe, acted as the CROSSROAD downloader: it performed basic reconnaissance, retrieved additional components, installed persistence via a scheduled task (observed as RadminComponentRuntime), and then self-deleted to reduce forensic traces. CROSSROAD in turn delivered SHINYROAD, a backdoor that sideloads a malicious DLL through a legitimate, digitally signed Radmin executable — a technique known as DLL side-loading that lets the malicious code run under the cover of a trusted binary. SHINYROAD supports a remote shell and runtime code injection, giving the attacker hands-on-keyboard access to infected machines.

A credential-theft attempt via WebDAV

During the July 20, 2026 window, researchers also observed an attempt to steal Windows authentication material without deploying malware at all: an invisible notification window was made to request a remote WebDAV resource, a technique that can leak NetNTLMv2 credential hashes to an attacker-controlled server for offline cracking or relay attacks.

Legitimate cloud infrastructure as cover

Some of the malicious payloads and communications were observed routing through legitimate cloud storage endpoints, including Alibaba OSS (serv.oss-cn-hongkong.aliyuncs.com) and Google Cloud Storage (storage.googleapis.com), alongside attacker-registered infrastructure such as storage-data.com and its subdomains and the IP 8.210.84.56. Using trusted cloud hosting helped the traffic blend in with normal update and telemetry activity.

Impact Assessment

Impact Area	Description
Scope	Opportunistic — any AOMEI Backupper or AnyViewer client checking for updates during a tampering window could be affected; GTIG warns actual reach may exceed confirmed cases
Confirmed victims	Organizations across 11 countries in IT services, telecommunications, and higher education
Malware capability	SHINYROAD backdoor grants remote shell and code execution, enabling follow-on malware deployment, lateral movement, or data theft
Credential exposure	NTLM hash theft attempt observed during one window, risking offline cracking or relay attacks
Detection difficulty	Short-lived (5-10 minute) tampering windows and restoration of legitimate files make retrospective detection difficult
Vendor trust	Undermines confidence in AOMEI's update channel, since the compromise used the vendor's own infrastructure and valid-looking checksums

Recommendations

For AOMEI Backupper and AnyViewer administrators

Check Windows Task Scheduler for a task named RadminComponentRuntime, which is not part of a normal AOMEI installation.
Search AOMEI installation directories for an unsigned upgrade-now.exe or upgrade-now.zip.
Review outbound network logs for connections to promotion.storage-data.com, aomei.storage-data.com, storage-data.com, and the IPs 8.210.84.56, 47.239.60.117, and 8.218.65.184.
Confirm whether an unexpected Radmin installation exists on endpoints running AOMEI software; Radmin is not bundled with standard AOMEI products.

For security teams

Run endpoint detection against the IOCs above; Malwarebytes/ThreatDown customers already have real-time coverage of the downloader under the detection name Malware.AI.4006642887.
Hunt for DLL side-loading involving signed Radmin binaries, since SHINYROAD relies on this technique to blend in with legitimate processes.
If NTLM hash theft is suspected, rotate potentially exposed credentials and review authentication logs for anomalous relay or pass-the-hash activity.
Treat any auto-update or promotional-content channel in third-party software as a supply chain risk worth monitoring, not just the software's core update mechanism.

For general users

Keep AOMEI Backupper or AnyViewer updated to the latest version now that the vendor has stated it upgraded servers and patched vulnerabilities.
Run a full malware scan if the software was in use between April and July 2026, particularly around the confirmed tampering dates of May 28, July 16, and July 20.
Watch for unexpected installations of remote-access tools like Radmin, which can indicate compromise even without other obvious symptoms.

Key Takeaways

Attackers compromised AOMEI's update servers, not the Backupper or AnyViewer software itself, by tampering with two configuration files for brief windows of just five to ten minutes.
The campaign, tracked as UNC7017 by Mandiant, ran from roughly April to July 2026 and delivered custom malware — the CROSSROAD downloader and SHINYROAD backdoor — built around a legitimate, signed Radmin executable.
One tampering window on July 20, 2026 also attempted to steal Windows NetNTLMv2 credential hashes via a WebDAV-triggering notification.
Because exposure depended on exact timing, the attack was opportunistic — confirmed victims span 11 countries and three sectors, but the true scope may be larger.
No CVE was assigned, since the compromise exploited server-side trust and checksum manipulation rather than a software vulnerability.
AOMEI confirmed remediation on July 29, 2026, stating it upgraded servers, patched vulnerabilities, and verified file integrity, though it has not disclosed how the initial server compromise occurred.