AOMEI Backupper: backdoor served by servers tampered for minutes

Between April and July 2026, a threat actor tracked by Google Threat Intelligence Group (GTIG) as UNC7017 repeatedly modified configuration files on the servers of AOMEI, maker of AOMEI Backupper, the Windows backup and disk cloning software also used by businesses and on Windows Server. Each tampering lasted five to ten minutes, after which the original files were put back. Installations that contacted the servers during those windows downloaded and ran a dropper and a backdoor, with no user interaction.

The activity was discovered by ManageEngine’s Threat Analysis Lab (METAL) and investigated further by GTIG and Mandiant; AOMEI confirmed the tampering to The Record.

How it was discovered

On May 28, ManageEngine’s endpoint security software logged AOMEI Backupper installing Radmin, a commercial remote administration tool, on two machines belonging to unrelated customers in different countries; both environments were in audit mode and nothing was blocked. Notified on June 7, AOMEI suggested the content had been altered in transit, but METAL pointed out that both endpoints had fetched the files over HTTPS from AOMEI domains, across different networks.

Repeating the download only returned clean files. After finding a matching dropper sample on VirusTotal, METAL monitored the servers continuously and on July 16 watched the malicious version being served live; on July 20 another window was captured by GTIG and Mandiant. The confirmed windows, according to BleepingComputer, are:

• May 28, 05:40–05:50 UTC;
• July 16, 08:33–08:39 UTC;
• July 20, 10:35–10:40 UTC.

Related samples, however, have been circulating since late April, and Google considers it likely that further windows occurred outside its visibility.

Technical details

Nothing in AOMEI Backupper was exploited, ManageEngine writes: the attackers abused the promotional content channel, background services that periodically poll AOMEI’s servers. Two files were tampered with:

• down_html.ini (on www2.aomeisoftware.com): tells the software which package to download and which checksum to expect. The attackers pointed it to a ZIP archive on their own infrastructure, with a matching checksum, so the check passed;
• Notifycfg.ini (on account.aomeitech.com): controls notifications and was set to open, in an invisible window, a page that launched the dropper.

According to METAL, neither file is cryptographically authenticated by the client, and the checksum sits in the same unauthenticated file that names the archive. Help Net Security reports that the activity affects version 8.3.0 and later.

The CROSSROAD dropper stopped if the machine appeared to be in China, if it could not determine its location or if it found certain security products. Otherwise it installed genuine Radmin Server together with a malicious DLL loaded through it, the modular SHINYROAD backdoor, which opens a reverse TCP connection to the command-and-control server; it then created a scheduled task relaunching it every three hours and deleted itself. According to SecurityWeek, AdaptAgent, part of the Adaptix C2 post-exploitation framework, was also delivered in July.

On July 20, Google observed a second technique: a 1×1 pixel window forced the client to request a WebDAV resource from an attacker-controlled server, sending the logged-in user’s NetNTLMv2 hash. No code needs to run, so machines where the dropper was blocked may still have exposed credentials.

Public indicators cited by BleepingComputer include 8.210.84[.]56, serv.oss-cn-hongkong[.]aliyuncs.com, hostnames under storage-data[.]com and the legitimate storage.googleapis.com endpoint. The full lists are in the GTIG and ManageEngine reports.

In our reading, the relevant MITRE ATT&CK techniques are T1195.002 (Compromise Software Supply Chain), T1053.005 (Scheduled Task), T1219 (Remote Access Tools), T1574 (Hijack Execution Flow), T1187 (Forced Authentication) and T1070.004 (File Deletion).

Victims and AOMEI’s response

Google identified and notified victims in IT services, telecommunications and higher education in eleven countries, including Spain, Portugal and Switzerland. The campaign hit anyone who checked for updates during the windows, so there are probably more victims. UNC7017 has not been linked to any country or known group, and the China exclusion does not establish where the attackers are based.

Mandiant notified AOMEI on July 17; on July 29 the company said it had taken corrective action. AOMEI told The Record it had not yet identified or notified affected customers and that it had released a free detection tool. How the attackers got in has not been disclosed, and ManageEngine has not independently verified that they lost access. According to ManageEngine, Google’s report also documents targeting of AnyViewer, AOMEI’s remote desktop product; the company maintains that only Backupper showed anomalies.

Impact for European and Italian organisations

No Italian victims have been named, but delivery was indiscriminate. Backup software runs with high privileges, reads all data and contacts its vendor on a schedule: ideal cover. For NIS2 entities this is a supply chain security case; a confirmed compromise should also be assessed for notification, bearing in mind that a stolen NetNTLMv2 hash can be used in later credential attacks.

What to do now

1. Inventory AOMEI Backupper (and AnyViewer) on workstations and servers, with versions.
2. Hunt for signs of compromise across the whole April–July period, not only the three windows: Radmin Server not installed by IT, unknown scheduled tasks running every three hours, unexpected executables in AOMEI folders, connections to the published indicators.
3. Check WebDAV/SMB traffic to the internet, especially on July 20: if present, treat the hashes of logged-in users as exposed and change their passwords. Blocking outbound SMB and WebDAV to the internet reduces the risk.
4. Update the software and use AOMEI’s detection tool: the server-side fix does not clean machines that were already infected.
5. If you find a compromise, isolate the machine, start incident response and reinstall.

How ARXDOME helps

The ARX Sentry agent collects the software, process and port inventory of Windows computers and servers: it helps you quickly find machines with AOMEI Backupper or Radmin. With ARX Trace you can run searches across many machines for scheduled tasks and suspicious files, and ARX Shield lets you isolate a compromised machine from the network until it is cleaned.

Last updated: 20 October 2026