AOMEI Backupper Supply-Chain Attack Spreads Malware in 11 Countries

Hackers broke into the servers behind AOMEI Backupper, a Windows backup tool, and used them to spread malware. Experts call this a supply chain attack because it abuses software people already trust.

The attacks ran from April to July 2026. Google and ManageEngine shared their findings last week. The hackers made a change, waited a few minutes, and then put everything back.

How the Attack Worked

AOMEI Backupper checks the company’s servers now and then. It looks for updates and promo pop-ups. Two small settings files control that process. The first, down_html.ini, tells the app where to get an update. The second, Notifycfg.ini, tells the app which notices to show and which programs to run.

The hackers edited both files. First, they pointed the app to a harmful ZIP file instead of AOMEI’s own download. They also changed the checksum, a code the app uses to confirm a download is real. As a result, the fake package passed the check. Next, the second file told the app to run the new program. The app only had to be open.

ManageEngine says the hackers did not use a software flaw. Instead, the app did what it was built to do. The weak spot is that it trusted settings files with no digital signature.

The Break-in Occurred in Three Short Windows

Experts confirmed three break-ins:

• May 28: 10 minutes, from 05:40 to 05:50 UTC
• July 16: 6 minutes, from 08:33 to 08:39 UTC
• July 20: 5 minutes, from 10:35 to 10:40 UTC

Google believes other windows went unseen. In fact, related malware samples showed up in late April. Google also says it has never seen a supply chain attack with Windows this short.

After each window, the hackers restored the original files. Therefore, a PC that checked before or after got clean files.

ManageEngine’s security software saw the first sign on May 28. AOMEI Backupper suddenly installed Radmin, a real remote-control tool, on computers at two unrelated companies in different countries. The installs looked odd because AOMEI’s pop-up feature launched them.

Experts then tried to repeat the attack in a lab. However, they only got clean files, because the servers had already reverted. So they set up automatic monitors on AOMEI’s servers. On July 16, a monitor caught the changes as they happened. Google’s team saw the July 20 window.

What the Malware does on Infected Devices

The first program, CROSSROAD, scans the PC and downloads more tools. It then sets up a task that runs every three hours and deletes itself. It also quits on computers that appear to be in China.

The second program, SHINYROAD, is a backdoor. It hides behind a real, signed Radmin file and loads the hackers’ own code. Then it connects to a server the hackers control. ManageEngine found Radmin installed but saw no sign it was running. Instead, the outbound link did the work.

On July 20, the hackers added a second trick. They swapped a “World Cup Deals” pop-up for an invisible one-pixel window. That window made the PC contact the hackers’ server and send Windows login hashes. A hash is a scrambled version of a password, and hackers can try to crack it later. Google says this could work even if the malware fails to run.

Victims of the Attack

Google found victims in IT services, telecom, and higher education. They sit in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. Still, Google warns the real number is likely higher. The attack reached any PC that checked for updates during a window.

Data exposure has also affected other major organizations. Qantas confirmed a dark web data leak following a July cyber breach, highlighting the risks organizations face when attackers gain access to sensitive information.

Google’s report also covers AnyViewer, AOMEI’s remote access tool. ManageEngine saw the activity on Backupper version 8.3.0 and later. Google tracks the group as UNC7017.

AOMEI’s Response

ManageEngine says it warned AOMEI on June 7. At first, AOMEI suggested someone had altered the files in transit. Experts disagreed. Both PCs had pulled the files over secure connections from AOMEI’s own addresses, in different countries. Mandiant then alerted AOMEI on July 17, and AOMEI replied on July 29 that it had taken action.

AOMEI told ManageEngine it upgraded its servers, patched weak spots, and checked its files. ManageEngine says it cannot yet confirm the problem is contained. Meanwhile, AOMEI told BleepingComputer it treats the matter as high priority, and its CTO is leading an investigation. The company has not said how the hackers got in.

Next Step for Users and IT Teams

Server fixes only stop new infections. Therefore, teams should hunt for old ones. Experts suggest these checks:

• Look for tasks named RadminComponentRuntime or NitroRuntime.
• Check the Radmin folder under %LOCALAPPDATA% for an unsigned file called BlkScrDl.dll.
• Look for any .exe program inside AOMEI’s HTML folder, where only web files belong.
• Block traffic to 8.210.84.56, 8.218.65.184, 47.239.60.117, and storage-data.com.
• Block outbound file-sharing and WebDAV traffic to outside addresses.

Also, do not test AOMEI’s download link to judge an alert. It will look clean now. Instead, review saved copies of the settings files and network logs from the time of the alert. Because the July 20 trick targeted logins, resetting passwords on exposed machines is a sensible extra step.