Between May and June 2026, attackers compromised AOMEI’s update infrastructure and used it to deliver malware to users of AOMEI Backupper. The campaign was a supply-chain attack without modified code: no vulnerability was exploited and no stolen certificates were used.
Instead, the attackers briefly changed unsigned configuration files on AOMEI-operated servers—including down_html.ini and Notifycfg.ini—for only five to ten minutes at a time. During those windows, AOMEI Backupper clients were redirected to malicious ZIP archives. The files were then restored, making later audits and scans appear clean. Any system that checked for updates during an active window received malware from what looked like a trusted vendor source.
Confirmed tampering windows included May 28, July 16, and July 20, 2026. Because the windows were so short, additional compromises may have gone undetected.
Malware Chain
The malicious ZIP delivered a downloader called CROSSROAD. It performed environment and geographic checks, staged additional payloads, created a scheduled task for persistence, and then deleted itself from disk.
The scheduled task launched SHINYROAD, a modular backdoor that abused a legitimate signed Radmin executable through DLL search-order hijacking. SHINYROAD used an embedded PocketPy interpreter to execute encrypted Python bytecode in memory and maintained encrypted command-and-control communications with randomized junk traffic. It supported remote-shell access and the ability to download and execute additional code.
Later stages deployed ADAPTAGENT, an Adaptix C2 framework agent disguised as Nitro PDF software.
A separate credential-theft technique appeared on July 20. The notification configuration was modified to display an invisible one-pixel popup that coerced Windows into sending NetNTLMv2 authentication hashes to attacker-controlled WebDAV infrastructure. This could work even where the malware itself was blocked.
Scope and Impact
The campaign was opportunistic rather than targeted. Compromised organizations were identified in 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. Affected sectors included IT services, telecommunications, and higher education.
Because the malware arrived through AOMEI’s normal update workflow, it bypassed routine security checks that rely on file scanning or point-in-time triage.
Disclosure Problems
The activity was first detected in late May 2026, and AOMEI was warned in June. AOMEI initially attributed the issue to attackers intercepting updates in transit rather than a compromise on its own end.
The attackers struck at least twice more after that first warning. AOMEI later acknowledged that it could identify traces of the intrusion only after being given the specific time of the July tampering and analyzing server logs. AOMEI said it then updated its servers and found no further malicious files.
As of reporting, AOMEI had not identified or notified infected customers. Server-side remediation does not remove malware already installed on victim endpoints. Organizations should hunt for indicators of compromise across the entire April–July timeframe.
Why This Campaign Matters
The attackers did not compromise customer environments directly. By altering only unsigned server-side configuration files for minutes at a time, they controlled where clients downloaded content from, what files were accepted as valid, and what content was executed—all through the application’s normal update workflow.
This is a shift away from supply-chain attacks that alter code and leave forensic signatures, toward ephemeral configuration tampering that exploits trust in update infrastructure without touching legitimate software.
Recommendations
Organizations that used AOMEI Backupper or AnyViewer during the April–July 2026 window should:
- Hunt for indicators of compromise, including CROSSROAD and SHINYROAD artifacts, scheduled tasks, and anomalous WebDAV or NetNTLM authentication traffic.
- Assume that AOMEI’s server-side fixes did not remediate endpoints that executed the malicious payloads.
- Review backup servers and administrator workstations with particular urgency, as these systems typically hold privileged access and broad visibility into the environment.