Hackers Hijacked Backup Software Updates in Brief Windows, Hit 11 Countries

Attackers spent just five to ten minutes at a time swapping out legitimate software updates on a vendor's own servers, but that was enough to plant backdoors on computers in at least 11 countries, according to a disclosure this week from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab. The campaign targeted AOMEI Backupper, a Windows backup and disk-cloning program made by Hong Kong-registered AOMEI Technology, repeatedly tampering with its update mechanism between May and July 2026. Any machine that happened to check for an update during one of those narrow windows pulled down malicious files instead of genuine ones, and the vendor's server fix doesn't remove the backdoor from systems already infected.

The researchers confirmed three specific tampering windows: 10 minutes on May 28 from 05:40 to 05:50 UTC, six minutes on July 16 from 08:33 to 08:39 UTC, and five minutes on July 20 from 10:35 to 10:40 UTC. Google's telemetry identified compromised organizations in IT services, telecommunications, and higher education spread across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States, though the report notes the actual count is likely higher than what was detected. The attack worked because AOMEI Backupper doesn't cryptographically verify the files it downloads from update servers, and the checksum meant to confirm authenticity sits inside the same unsigned file that names the update package. No software vulnerability was exploited, and no user action was required beyond having the program installed and running—the attacker simply changed two text files on the server for a few minutes, and copies of Backupper that checked in during those windows fetched the attacker's package and ran it with the privileges of the AOMEI process.

"Organizations running AOMEI software cannot assume they are protected solely because the vendor took corrective server-side action," the report warns. ManageEngine's lab caught the first activity on May 28 when it recorded AOMEI Backupper installing Radmin on two unrelated customers in different countries, notified AOMEI on June 7, and said AOMEI initially claimed the content had been intercepted in transit—an explanation the lab rejected because both machines had fetched files over HTTPS from AOMEI's own servers across different networks. Mandiant notified AOMEI again on July 17 after catching one of the windows in real time, and AOMEI reported on July 29 that it had secured its servers, though ManageEngine said as of publication it hadn't independently confirmed containment. AOMEI's published changelog for Backupper through the current October 9 release, version 8.5.0, lists no change to how the program verifies updates, and neither report points to a version that closes the gap.

The attack's brevity made it exceptionally hard to detect and investigate. Google described this as the first supply chain compromise it has seen built on windows this short, calling it effective at "evading traditional point-in-time triage and automated file scanning." Because the tampered files reverted to genuine versions within minutes, the report explains, AOMEI's download page serves clean content almost all the time, which has led analysts to dismiss real detections as false alarms. On infected machines, a downloader called CROSSROAD unpacked a bundle into a local Radmin folder, set up a scheduled task to run every three hours, then deleted itself from disk—leaving the machine looking normal even while the backdoor remained active. The bundle included a signed copy of Radmin commercial remote-administration software, staged but never activated, alongside a separate implant called SHINYROAD that phones home to a single hard-coded address for remote shell access and can fetch and run new code on command.

The researchers urge organizations running AOMEI software to hunt across the entire April-to-July period, preserve files cached in the program's own folders, and check network logs for what was served at the exact time any alert fired. On endpoints, they recommend looking for a scheduled task named RadminComponentRuntime, an unsigned upgrade-now.exe file carrying AOMEI's publisher details, or any program running from Backupper's html pop-up folder. On the network, both reports provide infrastructure to block—including the domain storage-data[.]com and three IP addresses—and recommend blocking outbound SMB and WebDAV to external addresses to stop a credential-stealing trick used in the July 20 window, where an invisible one-pixel pop-up made Windows send the logged-in user's NetNTLMv2 authentication token to the attacker's server with nothing visible to the user. Google tracks the group behind the campaign as UNC7017 and has not attributed it to any country or known actor. For enterprises that rely on third-party tools with automatic update mechanisms, the campaign highlights how trust relationships with vendors extend past the software itself into the operational security of every server in the delivery chain—and how even a vendor's public response may not address the design choices that made the attack possible in the first place.