Attackers briefly altered files on AOMEI’s own update servers so that copies of the Windows backup program AOMEI Backupper that happened to check for updates would download and run a backdoor. Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine’s Threat Analysis Lab disclosed the campaign this week. They confirmed three tampering windows (May 28, July 16 and July 20, lasting 5 to 10 minutes each) and say more probably happened that they did not see.
No software vulnerability was exploited. According to the reports, Backupper does not cryptographically verify the two text files that drive its update and pop-up checks, and the checksum meant to validate a download sits inside the same unsigned file. Changing those files for a few minutes was enough: a machine that checked in during a window pulled the attacker’s package, and the pop-up configuration then ran it. GTIG, which tracks the actor as UNC7017 and names no country, found affected organizations in IT services, telecommunications and higher education across 11 countries and says the true number is likely higher. The payload included a downloader (CROSSROAD) that sets up a scheduled task, then a backdoor (SHINYROAD) loaded through a legitimate, signed copy of the Radmin remote-admin tool; on some machines GTIG saw the open-source Adaptix C2 framework added, disguised as Nitro PDF. The July 20 window also tried to make Windows leak the user’s NetNTLMv2 authentication response through an invisible WebDAV pop-up, with no program needing to run.
AOMEI told Mandiant on July 29 that it had secured its servers, but a server fix does not clean machines that were already hit, and ManageEngine said it had not independently confirmed containment. Neither report says how the attacker reached AOMEI’s servers, and The Hacker News found no change to how Backupper verifies updates in the changelog through the current release, 8.5.0 (October 9).
How to check if you’re affected
Affected products are installs of AOMEI Backupper for Windows that checked for updates during a tampering window; the lab examined version 8.3.0 and neither report lists which versions are affected. GTIG says AnyViewer, AOMEI’s remote-desktop tool, uses the same update flow, though the detections it describes involve Backupper. Both research teams urge organizations running AOMEI software to hunt across the whole April-to-July period rather than assume the vendor’s fix protects them. Because the malware restored the local update file after running, a machine can look normal and the vendor’s download page now serves genuine files, so do not judge an alert by re-downloading from AOMEI.
On the endpoint, the reports list:
- A scheduled task named
RadminComponentRuntime(orNitroRuntimefor the follow-on tool). - An unsigned
upgrade-now.execarrying AOMEI’s publisher details, or any program running from Backupper’s html pop-up folder. - Attacker files staged under the local Radmin application-data folder.
On the network, block storage-data[.]com, promotion.storage-data[.]com, aomei.storage-data[.]com and the IPs 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117, and look for traffic to them in logs. The reports also advise blocking outbound SMB (TCP 445) and WebDAV to external addresses to stop the credential-leak trick, and preserving cached files from the program’s own folders. GTIG published YARA rules and ManageEngine published Sigma rules with their reports.