AOMEI Backupper servers hijacked to spread malware
Cyber‑security researchers uncovered that attackers briefly altered AOMEI Backupper’s update infrastructure to deliver malware, exposing more than 100 million users worldwide.
20 Oct 2026 0 reads Compiled with AI
#AOMEI #AOMEI Backupper #Google Threat Intelligence Group
In a supply‑chain attack that began in April and lasted until July 2026, hackers temporarily took control of the update servers that deliver new builds of AOMEI Backupper, a Windows backup program used by more than 100 million people worldwide.
The attackers altered two configuration files that tell the software where to download updates and how to validate them. The files, named down_html.ini and Notifycfg.ini, were briefly rewritten to point to a malicious ZIP archive and to change the expected checksum. By doing so the software accepted and extracted the payload without user interaction.
How the malware spread
When the malicious archive was downloaded the installer launched a downloader called CROSSROAD, which added additional components and set up a scheduled task for persistence. A second payload, a backdoor named SHINYROAD, reused the legitimate Radmin components to open a connection to a command‑and‑control server. Both malware pieces were only active during three short windows – 10 minutes on 28 May, 6 minutes on 16 July, and 5 minutes on 20 July – after which the files were restored to their original state.
Security researchers from Google Threat Intelligence Group, ManageEngine’s Threat Analysis Lab and Mandiant identified the campaign and traced the actors to a threat group called UNC7017. AOMEI notified the investigators in early June and, after the July 16 incident, moved its configuration files to new infrastructure with detailed logging. The company has patched the vulnerability and confirmed that the files it now hosts are correct, but researchers warn that any machines infected during the brief windows may still retain the backdoor.
What users should do
Users who ran AOMEI Backupper during the affected period should update their security software and run a full scan. In Windows Task Scheduler look for a task named RadminComponentRuntime, and inspect the Backupper installation folder for an unsigned upgrade‑now.exe or an unexpected upgrade‑now.zip. Outgoing traffic to hosts such as promotion.storage‑data.com or 8.210.84.56 may indicate a compromised machine; Malwarebytes and other security vendors can detect the initial downloader known as upgrade‑now.exe.