Supply chain

Between April and July 2026, attackers repeatedly changed two configuration files on the servers that AOMEI Backupper, a widely used Windows backup and disk cloning tool, polls for updates and pop-up notifications. Each change lasted five to ten minutes before the original file came back. Any copy of Backupper 8.3.0 or later that checked in during a window downloaded and ran a backdoor. Google Threat Intelligence Group (GTIG) tracks the attackers as UNC7017 and has not tied them to a country or known group.

On October 19, AOMEI released Backupper 8.5.1, which changes how the client fetches and trusts those files. The update does not remove anything already installed. Confirmed victims sit in IT services, telecommunications and higher education across 11 countries, and GTIG calls the targeting opportunistic and likely broader than what it has seen. If Backupper runs anywhere in your estate, the job now is to update it and check each machine for the indicators below. AOMEI AnyViewer, a remote support tool, uses the same update mechanism, and researchers say it was targeted too.

How it works

Backupper ships two background processes that talk to AOMEI over HTTPS. Backupper.exe reads down_html.ini from www2.aomeisoftware.com, which names a zip package to download and the MD5 hash it should have. ABNotify.exe reads Notifycfg.ini from account.aomeitech.com, which controls promotional pop-ups and can name a local file to open. The client unpacks the package into a Tmphtml folder, moves it into an html folder under the install directory, and renders it in a built-in browser.

Neither file was signed, and the hash that protects the download sat in the same unsigned file as the download URL. Whoever can edit down_html.ini can point it at their own zip and supply its matching MD5, and the integrity check passes. HTTPS only proves the file came from AOMEI's server, which is exactly where the change was made. ManageEngine's Threat Analysis Lab (METAL) ruled out tampering in transit for that reason, after AOMEI first suggested it.

On July 16 the attackers pointed down_html.ini at promotion.storage-data.com, bumped the version field and swapped in a new MD5. They also changed Notifycfg.ini so the client would open the unpacked upgrade-now.exe from its html folder. No user click and no software vulnerability was needed; the app only had to check in. On July 20 the first download came from a Google Cloud Storage bucket instead, which GTIG says helped it pass proxies that block newly registered domains.

That second window also carried a different trick. Notifycfg.ini opened an invisible 1x1 pixel pop-up pointing to a file:// path on a WebDAV server at 8.210.84.56. Windows authenticates to such shares automatically, so the machine sent the signed-in user's NetNTLMv2 hash, a password-derived challenge response that can be cracked offline or relayed. Nothing ran on the endpoint, so machines where security tools blocked the dropper may still have leaked credentials.

What attackers did on infected machines

The dropper, which Google calls CROSSROAD, is an unsigned upgrade-now.exe carrying the misspelled product name "AOMEI Update Compent". It stops on machines that geolocate to China or whose location it cannot resolve, and on machines running certain security products. Otherwise it unpacks a component package into %LOCALAPPDATA%\Radmin\, creates a scheduled task named RadminComponentRuntime that runs every three hours and deletes itself.

SHINYROAD, the backdoor, rides on genuine Famatech-signed Radmin files. The signed FamItrfc.exe loads an attacker-built BlkScrDl.dll through DLL search-order hijacking, and that DLL runs an encrypted payload that connects to 8.218.65.184. Some May 28 victims also got a full Radmin Server install. From mid-July, GTIG saw an Adaptix C2 agent, an open source post-exploitation framework, disguised as a Nitro PDF component (NitroPromotion.exe in %LOCALAPPDATA%\Nitro Pro\) and started by a scheduled task called NitroRuntime.

Detection was slow because the windows were so short. ManageEngine's endpoint product logged Backupper installing Radmin on two unrelated customers in different countries on May 28, in audit mode, so nothing was blocked. A customer raised it on June 7 and METAL told AOMEI that day, but later checks of the same URLs returned clean files. METAL caught the July 16 window live, GTIG and Mandiant captured July 20, and Mandiant notified AOMEI on July 17. AOMEI said on July 29 that it had taken corrective action. It has not said how the attackers got into its servers.

What to do

1. Update to Backupper 8.5.1. The changelog says it disables the in-app entry points for promotional pop-ups and automatic updates, adds "asymmetric encryption" for remote .ini files, drops www2.aomeisoftware.com and only fetches updates from official AOMEI sites. AOMEI does not spell out whether the client now verifies a signature, which is the property that matters. We found no matching AnyViewer release note, so ask AOMEI about AnyViewer directly.
2. Block the infrastructure now. GTIG lists storage-data.com and its promotion and aomei subdomains, plus 8.210.84.56, 8.218.65.184 and 47.239.60.117. Block outbound SMB (TCP 445) and WebDAV to the internet, which stops the hash leak whatever app triggers it.
3. Check every host that ran Backupper or AnyViewer between April and July. Look for the scheduled tasks \RadminComponentRuntime and \NitroRuntime, the folders %LOCALAPPDATA%\Radmin\ and %LOCALAPPDATA%\Nitro Pro\, and any executable in the AOMEI html folder, such as upgrade-now.exe. In endpoint telemetry, search for ABNotify.exe or Backupper.exe starting an unsigned child process, and for any process run with --runtimechk. A signed FamItrfc.exe is no proof of innocence; it is the abused file.
4. Search proxy logs for the User-Agent Anyviewer-loader/1.0 and for requests to serv.oss-cn-hongkong.aliyuncs.com, the Alibaba Cloud storage host used in April and May.
5. Preserve before cleaning. Copy the Tmphtml and html folders under %PROGRAMFILES(X86)%\AOMEI\ first. Both GTIG and ManageEngine warn that checking AOMEI's URLs today proves nothing, because the server copy was restored within minutes.
6. Treat a hit as a full compromise. Re-image the machine rather than deleting files, and reset the password of every account that signed in to it. For machines that checked in on July 20 between 10:35 and 10:40 UTC, reset the signed-in user's password even with no malware found, since the NetNTLMv2 hash may have left.

GTIG's report carries full hashes and YARA rules, and ManageEngine's carries Sigma rules for executables written to tmphtml and launched from html. AOMEI's own statement also points users to its security scanner.

Why backup software is worth the effort

Backup agents run with high privileges on servers and admin workstations, are trusted by security tools, and are rarely watched once installed. This one also fetched instructions from a marketing system that could start local programs. Ask every vendor whose agent runs on your servers whether update packages and configuration files are signed and checked on the client, and keep marketing pop-ups out of production builds where the product allows it. Alert on any child process an updater starts that is unsigned or signed by someone else.

Our security operations team hunts for this kind of quiet persistence across endpoints, and safeguarding and hardening covers egress rules such as outbound SMB and WebDAV blocking. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Google Threat Intelligence Group, ManageEngine Threat Analysis Lab, AOMEI statement, AOMEI Backupper changelog, Help Net Security, IT-Connect, BleepingComputer, Field Effect.