Attackers briefly altered configuration files on AOMEI’s servers between April and July 2026 so that AOMEI Backupper, a Windows backup and disk-cloning program, would fetch and run a downloader called CROSSROAD that installed a backdoor named SHINYROAD. Google’s Threat Intelligence Group and Mandiant track the campaign as UNC7017, and ManageEngine’s Threat Analysis Lab was the first to spot it. The server fix does not remove a backdoor already on an infected PC.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Minutes-long tampering on AOMEI’s servers
Google’s report, written by Tyler McLellan, says the malicious changes were live for only minutes before being reverted. The confirmed windows were May 28 for 10 minutes, July 16 for 6 minutes and July 20 for 5 minutes, all in UTC, and Google says more windows likely occurred. Any computer running AOMEI Backupper that checked for updates during a window could have been served the malicious package.
The mechanism relied on two configuration files, down_html.ini and Notifycfg.ini, that control where update packages are downloaded and what the notification system displays or runs. BleepingComputer’s Oct. 19 report says the attacker redirected the software to a malicious ZIP archive, changed the expected checksum so the file passed verification, and used the notification mechanism to run it without user interaction. ManageEngine’s report, by researchers Vishal Santharam, Praveen Kumar D and Veeramani Somasundaram of its Threat Analysis Lab with validation from Google and Mandiant, stresses that “Nothing in AOMEI Backupper was exploited” in the usual sense: neither file is authenticated by the client, and the checksum was declared in the same unauthenticated file it was meant to protect.
CROSSROAD, SHINYROAD and the stolen hashes
Google’s technical analysis describes CROSSROAD as a downloader that checks for AOMEI in its own path, looks up the host’s location and aborts on a result from China, then creates a scheduled task called RadminComponentRuntime. ManageEngine adds that a scheduled task runs the Radmin launcher every three hours and that the dropper halts if certain endpoint security agents are present. SHINYROAD is a modular Python-based backdoor loaded by side-loading a malicious DLL next to a signed Radmin binary, and it connects to a command server controlled by the attacker. Late-stage implants disguised as a Nitro PDF component were also found.
A second technique on July 20 needed no code execution. An invisible popup pointed Windows at a remote WebDAV path, which could make a machine hand over NetNTLMv2 authentication material that attackers can later try to crack offline.
Google also reported anti-forensic steps: the loader restores the local configuration file to its legitimate values and deletes itself using an NTFS alternate data stream. In its words, the technique was “effectively evading traditional point-in-time triage and automated file scanning,” as The Hacker News reported on Oct. 16. That matters for victims because checking AOMEI’s servers today will show clean files, and ManageEngine advises preserving evidence and bringing in incident-response specialists before changing anything. It also says the affected environments ran behavioral security policies in audit mode, which recorded but did not block the activity.
Who was hit and what AOMEI has said
Google and ManageEngine identified affected organizations in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkiye and the United States. Google calls the targeting opportunistic and says the real number of victims is probably higher. The timeline starts on May 28, when ManageEngine’s endpoint security flagged Backupper silently installing the legitimate Radmin remote administration tool at two unrelated companies in different countries.
ManageEngine notified AOMEI on June 7. AOMEI first suggested the files had been intercepted in transit, a theory ManageEngine rejected, stating that the evidence did not support AOMEI’s explanation of interception in transit. Mandiant notified AOMEI on July 17, and on July 29 AOMEI told Google it had taken corrective action. AOMEI told BleepingComputer it had classified the report as a high-priority matter and that its chief technology officer was leading an internal investigation, but it did not confirm how the attackers got in or whether the compromise is fully resolved.
The warning for anyone who ran the software in the spring or summer is blunt. Google and Mandiant said organizations “cannot assume they are protected solely because the vendor took corrective server-side action.” ManageEngine, whose advice BleepingComputer summarizes, says a server-side fix stops new infections but leaves backdoors installed during earlier windows in place, and recommends hunting through April-to-July activity. Indicators include the RadminComponentRuntime and NitroRuntime scheduled tasks, unsigned child processes spawned by AOMEI processes, and unexpected executables in AOMEI installation directories.
The Cloud Security Alliance’s AI Safety Initiative, in an Oct. 17 research note, adds that AOMEI’s AnyViewer remote-access product polls the same update mechanism, that the checksum sat in the same unsigned file as the download address, and that HTTPS protected the transport but could not detect altered content on the server. It recommends inventorying every AOMEI Backupper and AnyViewer installation, including user-installed and managed copies. Neither report explains how the attacker got access to the servers, and ManageEngine had not independently verified that AOMEI’s infrastructure is now clean when it published. Two checks matter most for an affected organization: whether any machine polled for updates during the three confirmed windows, and whether the cached configuration files from those days were preserved before anyone cleaned them up.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
