AOMEI Backupper Supply-Chain Attack: Hunt the Five-Minute Update Windows

AOMEI Backupper Supply-Chain Attack: Hunt the Five-Minute Update Windows

Attackers compromised the update infrastructure used by AOMEI Backupper and briefly redirected customers toward malware. The campaign did not require a software vulnerability or a permanently poisoned installer. Instead, the operators altered remote configuration files for only a few minutes, delivered a malicious package, and restored the legitimate content before most point-in-time checks could see it.

Google Threat Intelligence Group and Mandiant track the activity as UNC7017. ManageEngine’s METAL team observed the same chain on customer endpoints. The payload family includes the CROSSROAD downloader and SHINYROAD backdoor, with a legitimate Radmin component used to blend persistence into normal administration software.

This is a software supply chain compromise with an important defensive lesson: a clean vendor server today does not prove that every endpoint which checked for updates yesterday is clean.

What happened

AOMEI Backupper’s background services periodically retrieve remote configuration files that control update and promotional content. Researchers found that attackers modified those files on isolated dates between April and July 2026. The observed windows lasted roughly five to ten minutes:

• 10 minutes on May 28;
• 6 minutes on July 16;
• 5 minutes on July 20.

During those windows, the configuration pointed clients to attacker-controlled or repurposed cloud-hosted locations. The files also changed version and checksum values so the client would accept and process the staged archive. Once the window closed, the authentic configuration was restored.

That timing is the point. A scanner that retrieved the file outside the tampering window could see a legitimate response. A vendor audit performed after the event could find little persistent evidence on the origin server. The compromise instead targeted the trust relationship between an installed application and its update logic.

The payload chain

The malicious archive delivered upgrade-now.exe, tracked by GTIG as CROSSROAD. The downloader performed environment checks, staged additional components, and created persistence through a scheduled task. The next stage used legitimate administration tooling, including Radmin components, alongside attacker-built libraries that loaded the SHINYROAD backdoor.

Researchers also observed a WebDAV-based NTLM credential-coercion path in one tampered configuration. That means defenders should investigate both malware execution and unexpected outbound authentication from systems running AOMEI software.

The chain illustrates why endpoint detection and response telemetry matters. The malicious update may no longer be available from the vendor, but its local behavior can leave durable clues: an unsigned executable in an AOMEI rendering directory, a Radmin installation without normal server configuration, an unusual side-loaded DLL, or a task named RadminComponentRuntime.

What defenders should hunt

Organizations running AOMEI Backupper should treat this as a retrospective threat hunting exercise, not a routine update check.

1. Establish exposure windows

Search proxy, DNS, firewall, and endpoint telemetry for AOMEI systems that contacted update or notification endpoints on May 28, July 16, and July 20. Include a wider period around each date because clocks, retries, and delayed execution can move the observable activity away from the server-side change.

2. Check for durable host artifacts

Look for:

• upgrade-now.exe or unexpected executables below an AOMEI html or rendering directory;
• the product string AOMEI Update Compent, including the misspelling;
• RadminComponentRuntime scheduled tasks;
• FamItrfc.exe launched from an unexpected parent or directory;
• BlkScrDl.dll, RuntimeComponent.dll, component.zip, or metadata.dat near a Radmin installation;
• unsigned files carrying AOMEI-like version metadata.

Review file creation, process, module-load, and scheduled-task events together. A single filename can be changed; the execution chain is harder to disguise consistently.

3. Review network indicators carefully

Google and ManageEngine published indicators including promotion.storage-data.com, aomei.storage-data.com, 8.210.84.56, and 8.218.65.184. Search historical DNS and proxy records, but do not make the absence of one indicator a clearance decision. The campaign shifted between dedicated domains, Alibaba Cloud storage, and Google Cloud Storage.

4. Investigate remote-access capability

The presence of Radmin does not by itself prove compromise. It does justify checking whether it was installed by an expected administrator, whether it has a legitimate server configuration, which DLLs it loaded, and whether it created outbound connections. Preserve evidence before deleting suspicious files or tasks.

Why vendor remediation is not enough

The vendor can secure its distribution servers while previously delivered malware remains on customer endpoints. In this case, the short tampering windows also mean that standard file reputation and periodic vulnerability scans may miss the initial delivery event.

Software vendors should cryptographically authenticate remote configuration, verify signatures before extracting or executing update content, and keep update metadata separate from attacker-editable routing data. Customers should monitor updater behavior as a security-sensitive process, maintain historical telemetry, and require independent validation for high-impact software that can execute with broad local privileges.

Bottom line

The AOMEI campaign turned a normal backup-product update check into a narrow delivery channel for a downloader and backdoor. The most valuable defensive action is retrospective: identify systems that contacted the update infrastructure during the known windows, then correlate those systems with process, file, scheduled-task, and network telemetry.

For incident response, server-side cleanup is only the beginning. The endpoint is where defenders can still determine whether the five-minute update window became a foothold.

References

1. Investigating Ephemeral Supply Chain Tampering
2. AOMEI Backupper supply-chain compromise: Investigation and analysis
3. AOMEI yet to notify customers after hackers hijacked its software updates