AOMEI told The Record attackers repeatedly altered AOMEI Backupper’s server configurations between April and July 2026, redirecting clients to malware; Google Threat Intelligence Group (GTIG) and Mandiant documented confirmed tampering windows of five to ten minutes. AOMEI says it has not yet identified or notified infected customers, while GTIG says it alerted the victims it identified.
The altered settings named an attacker-hosted ZIP and supplied the checksum used to validate it, while a second setting made the software execute the downloaded content. Because the client did not cryptographically authenticate those settings—and trusted a checksum in the same unauthenticated file as the package name—the malware could pass validation. Machines checking in during a window could receive CrossRoad, a downloader for the ShinyRoad backdoor, even though later checks found restored, legitimate content.
AOMEI says it updated the server and found no malicious files afterward, but ManageEngine has not independently verified that attackers lost access. For organizations running Backupper 8.3.0 or later, a clean current download cannot establish whether a host checked in during a confirmed or potentially unseen window. Other software that executes remotely fetched promotional content carries the same vendor-side trust-boundary risk.
AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at a time.