Attackers leveraged incredibly short windows, typically five to ten minutes, to change files on **AOMEI Technology's** update servers. During these precise intervals, any instance of the **AOMEI Backupper** Windows backup program checking for updates would download and execute a backdoor. Investigations by **Google Threat Intelligence Group (GTIG)**, **Mandiant**, and **ManageEngine's Threat Analysis Lab** revealed the campaign. While **AOMEI** has reportedly secured its servers, the fix does not remove the backdoor from systems already compromised. **AOMEI Backupper**, a Windows backup and disk-cloning tool from the Hong Kong-registered vendor, uses background services to regularly check **AOMEI's** servers over HTTPS for updates and promotional pop-ups. The vulnerability stemmed from the program's update mechanism, which relies on two files: `down_html.ini` (naming the update package and its checksum) and `Notifycfg.ini` (controlling pop-up content and execution). Crucially, the program lacked cryptographic verification for these files, and the checksum designed to validate the download resided within the same unsigned file that specified the update. This design flaw meant no software exploit or user action was required beyond having the program installed and running. Attackers merely needed to modify two text files on the server for a few minutes. Copies of **Backupper** that polled for updates during these brief windows downloaded the attacker's package into their own folders, subsequently running it with the privileges of the launching **AOMEI** process. On examined machines, this was sufficient to install system-wide software, though privilege elevation depended on the specific **AOMEI** service configuration. ### Ephemeral Tampering Across Eleven Countries **GTIG** and **Mandiant** confirmed three distinct tampering windows, with more likely occurring undetected: * May 28, 2026: 10-minute window (05:40 to 05:50 UTC) * July 16, 2026: 6-minute window (08:33 to 08:39 UTC) * July 20, 2026: 5-minute window (10:35 to 10:40 UTC) Only systems checking for updates during these precise moments were affected, making detection challenging. **GTIG** described the targeting as opportunistic. Telemetry identified compromised organizations in IT services, telecommunications, and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. The true number of affected entities is believed to be higher. **GTIG** noted that **AOMEI's** remote-desktop tool, **AnyViewer**, uses the same update flow, although current detections involve **Backupper**. The reports do not specify affected **Backupper** versions, with **ManageEngine's** lab examining version 8.3.0. **GTIG** tracks the group responsible as **UNC7017**, without attributing them to a specific country or known actor. This marks the first observed Windows-based supply chain compromise of such brevity, effectively bypassing traditional point-in-time triage and automated file scanning. ### The Malicious Payload: CROSSROAD and SHINYROAD Compromised machines received a downloader dubbed **CROSSROAD** by **GTIG**. This unpacked a malicious bundle into a local **Radmin** folder, created a scheduled task to run every three hours, and then self-deleted. The bundle included a legitimate, signed copy of **Radmin**, a commercial remote-administration tool. However, **ManageEngine's** lab found it staged but inactive; remote control was instead facilitated by a separate implant.  The scheduled task executes the signed **Radmin** program, which sideloads an attacker-built DLL. This DLL, in turn, loads the **SHINYROAD** implant, providing a remote shell and the ability to fetch and execute new code. **SHINYROAD** communicates with a single hard-coded address, meaning blocking this address can sever attacker control. **CROSSROAD** includes geo-fencing, stopping execution if the machine is located in China, and also halts if specific security agents are detected. On systems that passed these checks, **GTIG** observed a second tool, the open-source **Adaptix C2** framework (disguised as Nitro PDF software), being deployed via **SHINYROAD**. ### A Covert Credential Theft Mechanism The July 20 window included an additional, stealthier attack. **GTIG** discovered that the notification file was altered to display an invisible, one-pixel pop-up. This pop-up pointed to a file on an attacker's server via **WebDAV**, a protocol allowing remote file access as if local. Rendering this pop-up could cause Windows to send the logged-in user's **NetNTLMv2** authentication response—a token attackers can crack offline or reuse—to the attacker's address, all without user visibility. This method of credential exfiltration did not require any program execution, meaning even machines with the backdoor blocked could still have leaked tokens. ### AOMEI's Response and Ongoing Concerns **ManageEngine's** lab first detected suspicious activity on May 28, when **AOMEI Backupper** installed **Radmin** on two unrelated customer systems. After a customer inquiry on June 7, **AOMEI** was notified the same day. Initial explanations from **AOMEI** suggested content interception in transit, an explanation **ManageEngine** found inconsistent with the evidence. Both affected machines fetched files over HTTPS from **AOMEI's** own servers across diverse networks, following normal update procedures. Mid-July monitoring by **ManageEngine** confirmed the changes were served directly from **AOMEI's** side. **Mandiant** informed **AOMEI** on July 17 and provided indicators. On July 29, **AOMEI** stated it had taken corrective actions to secure its servers. However, **ManageEngine's** lab had not independently confirmed the compromise's containment at the time of publication. Neither report details how attackers gained access to **AOMEI's** servers. Furthermore, **AOMEI's** public changelog for **Backupper** (up to version 8.5.0 as of October 9) shows no changes to the program's update verification process, suggesting the underlying vulnerability remains unaddressed in the client software. ### Post-Compromise Remediation and Detection Organizations running **AOMEI** software cannot assume protection simply because the vendor has taken server-side action. The downloader's setup of a scheduled task and subsequent restoration of local update files means an infected machine can appear normal, while the vendor's download page also looks clean. **GTIG** and **ManageEngine** strongly advise organizations to conduct thorough investigations spanning the entire April-to-July period. It is critical not to dismiss alerts based on current vendor download pages. Due to the rapid file changes, these pages almost always serve genuine content, which has led to legitimate detections being miscategorized as false positives. Preserve cached files in the program's folders and examine network logs for content served at the exact time an alert fired. On endpoints, hunt for: * **Scheduled task**: `RadminComponentRuntime` or `NitroRuntime` (for the follow-on tool) * **File**: An unsigned `upgrade-now.exe` carrying **AOMEI's** publisher details, or any program running from **Backupper's** `html` pop-up folder. * **Folder**: Attacker files staged under the local `Radmin` application-data folder. On the network, block known attacker infrastructure detailed in both reports, and restrict outbound SMB (TCP 445) and WebDAV to external addresses to prevent the credential theft technique.