Attackers tampered with the update servers for AOMEI Backupper, a Windows backup and disk-cloning tool, during several brief intervals between May and July 2026, according to Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab. The attackers changed two text files that the software fetches from AOMEI's own servers, and any copy that checked for updates during those windows downloaded and ran a backdoor.
The campaign relied on a weakness in the update process rather than a software vulnerability. The files that control updates, down_html.ini and Notifycfg.ini, are not cryptographically verified, and the checksum meant to validate the download sits inside the same unsigned file that names the package. Researchers identified three tampering windows lasting five to ten minutes each on May 28, July 16, and July 20, and said more likely occurred that they did not observe. Affected organizations were found in 11 countries, spanning IT services, telecommunications, and higher education.
The backdoor involved a downloader called CROSSROAD, a genuine signed copy of Radmin, and a DLL that loads the SHINYROAD implant. On July 20, a second technique changed the notification file to open an invisible WebDAV pop-up, which could leak Windows authentication tokens without running any program. AOMEI has reported fixing its servers, but that fix does not remove the backdoor from machines already infected. ManageEngine said its endpoint software first caught the activity on May 28 and notified AOMEI on June 7; AOMEI initially said the content had been intercepted in transit, an explanation the researchers said the evidence did not support.