Trojanized updates to AOMEI backup software installed a backdoor, and infected machines stay infected

On May 28, 2026, ManageEngine's detection tool spots an anomaly at a customer: the AOMEI Backupper backup software has just installed Radmin, a legitimate remote-access program. The same sequence appears on the computer of another, unrelated company in another country. In both cases, the installation was launched by the software's built-in promotion module.

This was the first clue to a supply chain attack against the Chinese vendor AOMEI. Google's Threat Intelligence Group (GTIG) and its subsidiary Mandiant detailed it on October 15, and ManageEngine's lab on October 16. From April to July 2026, a group Google tracks as UNC7017 repeatedly modified files served by AOMEI's own servers. Each modification stayed online for only five to ten minutes, then the genuine files came back. Two products are affected: AOMEI Backupper (ManageEngine observed it starting with version 8.3.0) and AnyViewer, the vendor's remote desktop tool.

Two text files, and the software does the rest

No software vulnerability was exploited. The attackers modified two configuration files: one tells the software where to download its packages, the other drives the notifications shown to the user. They also replaced the expected checksum, so the malicious archive passed verification. The notification then launched the program, with no action from the user. "The mechanism worked exactly as designed," ManageEngine sums up.

Three windows were observed directly: 10 minutes on May 28, 6 minutes on July 16 and 5 minutes on July 20. A computer that queried the servers at that moment received a downloader, which Google named CROSSROAD. It inspects the machine, establishes persistence through a scheduled task and fetches the next stage: a backdoor, SHINYROAD, which hijacks genuine Radmin components to give the attackers remote access. On July 20, Google also observed a second technique: a hidden window forced Windows to connect to an attacker-controlled server, which could expose password hashes.

Who was affected, and how the vendor responded

Google lists organizations in 11 countries, including Spain, Portugal and Switzerland, in IT services, telecommunications and higher education. France is not on the list. But according to Google, victims were hit at random and are probably more numerous than those identified. The group is not attributed to any country.

Alerted by ManageEngine on June 7, AOMEI first argued that the files had been intercepted in transit, an explanation the researchers say is contradicted by the evidence. After Mandiant's alert on July 17, the vendor stated on July 29 that it had taken corrective measures on its servers. In the BleepingComputer article published on October 19, it says it is treating the matter as a "high priority," led by its chief technology officer. It has not explained how the attackers got in.

What to do if AOMEI runs in your environment

As with the trojanized update of the Rank Math PRO WordPress plugin, the danger came from the trusted channel itself. And the fix applied on the servers does not clean machines that are already infected, Google and ManageEngine warn.

• Search the April–July 2026 period for the indicators published by Google and ManageEngine, including the IP address 8.210.84[.]56 and domain names under storage-data[.]com.
• Look for scheduled tasks named RadminComponentRuntime or NitroRuntime and any unplanned Radmin installation.
• Monitor for unexpected executables in AOMEI folders and unsigned processes launched by the software.
• Block outbound SMB and WebDAV connections to the Internet.
• Do not rely on a one-off check of the vendor's addresses: the tampered files stayed online only a few minutes.

Google and ManageEngine also recommend that vendors sign their configuration files, not just their programs. AOMEI has not said whether it has done so.