Threats · 5h ago
AOMEI told The Record attackers repeatedly altered AOMEI Backupper’s server configurations between April and July 2026, redirecting clients to malware; Google Threat Intelligence Group (GTIG) and Mandiant documented confirmed tampering windows of five to ten minutes. AOMEI says it has not yet identified or notified infected customers, while GTIG says it alerted the victims it identified.
The altered settings named an attacker-hosted ZIP and supplied the checksum used to validate it, while a second setting made the software execute the downloaded content. Because the client did not cryptographically authenticate those settings—and trusted a checksum in the same unauthenticated file as the package name—the malware could pass validation. Machines checking in during a window could receive CrossRoad, a downloader for the ShinyRoad backdoor, even though later checks found restored, legitimate content.
AOMEI says it updated the server and found no malicious files afterward, but ManageEngine has not independently verified that attackers lost access. For organizations running Backupper 8.3.0 or later, a clean current download cannot establish whether a host checked in during a confirmed or potentially unseen window. Other software that executes remotely fetched promotional content carries the same vendor-side trust-boundary risk.
5 sources covering this story
AOMEI Backupper servers hijacked for minutes at a time to push backdoor - Help Net Security
An unknown number of AOMEI Backupper users had their computers compromised with a backdoor through an unusually stealthy supply chain attack.
The Record from Recorded Future
AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at a time.
AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.
Hackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers altered AOMEI Backupper update files for 5 to 10 minutes at a time, delivering SHINYROAD to systems that checked for updates
Part of the PlainSec briefing for 2026-10-20