AOMEI Backupper update files tampered for minutes at a time

On 15 October 2026 the Google Threat Intelligence Group (GTIG) and Mandiant published research on a supply chain compromise of AOMEI Technology's update infrastructure. A day later, ManageEngine's Threat Analysis Lab (METAL) published its own analysis of the same activity. Both say the attacker changed configuration files on AOMEI's servers for only a few minutes at a time, then put the clean files back.

GTIG tracks the cluster as UNC7017 and says it has not named a country or a known actor. That is the right level of caution, and this post follows it.

What happened

AOMEI Backupper is Windows backup and cloning software. Its background services poll AOMEI servers over HTTPS for updates and promotional pop-ups. Two files drive that: down_html.ini, which names the package and its checksum, and Notifycfg.ini, which controls the pop-up behaviour.

Per GTIG, the actor edited down_html.ini to point at attacker-controlled hosts and updated the MD5 value to match the malicious archive. Because the checksum lives in the same unsigned file as the download URL, it proves nothing about integrity. METAL makes the same point.

Dated events from the two reports, all 2026:

• April: earliest tampering windows, per GTIG.
• 28 May: tampering window of 10 minutes (05:40 to 05:50 UTC). The same day, ManageEngine endpoint telemetry recorded Backupper installing Radmin remote administration software on a customer machine, and a second unrelated machine in another country showed the same chain.
• 7 June: a customer escalated the alert and METAL notified AOMEI the same day.
• 16 July: a 6 minute window (08:33 to 08:39 UTC), caught live by METAL's monitors.
• 17 July: Mandiant notified AOMEI and shared indicators.
• 20 July: a 5 minute window (10:35 to 10:40 UTC).
• 29 July: AOMEI told Mandiant it had taken corrective action on its distribution servers.

GTIG says more tampering probably happened that it did not see.

The payload chain

Both reports describe a dropper that GTIG calls CROSSROAD. It checked the host location and stopped if the country code was CN, installed a genuine, signed copy of Radmin without configuring it, and created a scheduled task named RadminComponentRuntime that runs every three hours. A signed Radmin binary then side-loaded an attacker-built DLL, which loaded a backdoor GTIG calls SHINYROAD. On some machines GTIG saw the open-source Adaptix C2 framework pushed afterwards, disguised as Nitro PDF software with a task named NitroRuntime.

The 20 July window also added an invisible pop-up pointing at a WebDAV path. GTIG says this can make Windows send a NetNTLMv2 authentication response to the attacker without any program running.

Who was hit

GTIG lists IT services, telecommunications and higher education, across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. It describes the targeting as opportunistic: whatever machine polled during a window was a candidate. No total victim count has been published, and GTIG says the real number is likely higher.

What is not known

• How the attacker gained the ability to change files on AOMEI's servers. Neither report explains it.
• Which Backupper versions are affected. METAL examined the chain on v8.3.0 and later, but neither report gives a fixed version.
• Whether AOMEI's servers are fully clean. METAL says it has not independently verified containment.
• AOMEI's first explanation to METAL was that content was altered in transit. METAL says its evidence does not support that, because both machines fetched files over HTTPS from AOMEI's own hostnames.

What to do now

1. Search April to July 2026 telemetry for the scheduled tasks RadminComponentRuntime and NitroRuntime.
2. Look for an unsigned upgrade-now.exe carrying AOMEI publisher details, BlkScrDl.dll beside a Radmin install, and FamItrfc.exe started by a scheduled task.
3. Block storage-data.com and its promotion and aomei subdomains, and the IPs 8.210.84.56, 8.218.65.184 and 47.239.60.117. Block outbound SMB (TCP 445) and WebDAV to external addresses.
4. Preserve the tmphtml and html folders under the Backupper install before cleaning. Do not rely on checking the vendor URL today, because it now serves clean files.
5. Treat machines that ran the chain as compromised, and treat NTLM material from any machine that polled on 20 July as exposed. Check whether your endpoint policy was in audit mode, since METAL says the affected environments were detect only.

How this could have been avoided

• Sign configuration files and verify the signature in the client. A checksum delivered next to the URL it protects is not a control.
• Verify the Authenticode signature of anything before it is executed. The dropper was unsigned and carried AOMEI metadata.
• Keep marketing pop-ups out of execution paths. A notification channel should never be able to launch a binary.
• Restrict update downloads to approved vendor domains, and block file and UNC schemes in notification handlers.
• On the customer side, run endpoint rules in block mode for unsigned children of updater processes, and compare delivered update content against a baseline over time. METAL caught the July window that way.

Try it yourself

Updates are a trust boundary like any dependency. Walk through how provenance attestations let you check what a build or update really is.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GTIG and Mandiant: Investigating ephemeral supply chain tampering (15 Oct 2026)
• ManageEngine Threat Analysis Lab: AOMEI Backupper supply chain compromise
• The Hacker News coverage (16 Oct 2026)