The backdoor was on the update server for five minutes, which is why the alerts were dismissed as false positives

Google Threat Intelligence Group and Mandiant published research on 16 October into tampering with the update servers of AOMEI Technology, whose Backupper and AnyViewer products are Windows backup and remote-desktop tools. ManageEngine's threat lab published alongside it.

The attackers did not exploit anything. They changed two text files on AOMEI's own servers, left them in place for a few minutes, and put the originals back.

Three windows, and the ones nobody saw

GTIG directly observed three periods of tampering:

Each was "active for only five to ten minutes before reverting to authentic versions". Copies of the software that checked for updates inside a window downloaded and ran a backdoor. Copies that checked a minute either side received genuine files.

GTIG says plainly that this is new: "This is the first time that we have encountered a software supply chain compromise that was implemented with these very short windows, effectively evading traditional point-in-time triage and automated file scanning." It also says the three windows are what it could see, and that "it is probable that additional tampering occurred throughout the campaign that remained outside our visibility".

The Triage Trap

GTIG gave the consequence a name, and it is the most useful idea in the research.

"Because the threat actor reverted the remote configuration files within five to ten minutes, the vendor's server returns authentic, clean files most of the time, leading analysts to mistakenly dismiss the detection as a false positive."

Think about what that does to an ordinary investigation. An endpoint tool fires on backup software installing a remote-administration utility. The analyst goes to the vendor's site, downloads the update, checks it, finds it clean and signed, and closes the ticket. Every step of that was competent. The conclusion was wrong because the evidence had a shelf life of six minutes.

GTIG's instruction follows from it: "Defenders must not rely on live web checks." Look instead at the configuration files cached on the endpoint, and at proxy and firewall logs for the moment the alert fired.

Two unsigned files is all it took

The update flow reads two files from AOMEI's servers. One names the update package and carries the checksum used to verify it. The other tells the notification service what to show and what to run.

Neither is cryptographically verified. And the checksum intended to prove the package is genuine lives inside the same unsigned file that names the package, so an attacker who can change one can change the other. There is no independent check anywhere in the chain.

On 16 July the altered file also carried more than 35,000 lines of dummy sections, which reads like an attempt to push the real change past anything doing a quick visual diff.

What arrived

The downloader, CROSSROAD, validates its environment, stages its payload, creates a scheduled task that runs every three hours, and then deletes itself. In specific branches it aborts if an IP geolocation service reports the machine is in China.

The persistence is quietly clever. The bundle contains a genuine, signed copy of Radmin, a legitimate commercial remote-administration tool. The scheduled task runs that signed binary, which loads an attacker-supplied DLL sitting beside it, which loads the actual implant, SHINYROAD — a modular backdoor giving a remote shell and the ability to fetch and run new code. On some machines GTIG later saw the open-source Adaptix C2 framework pushed on top, disguised as PDF software.

SHINYROAD talks to a single hard-coded address with no fallback, which is the one piece of good news: blocking that address cuts the operator off.

The 20 July window carried something different again. The notification file was altered to open an invisible one-pixel window pointing at a file on an attacker's WebDAV server. Rendering it can make Windows send the logged-in user's authentication response to the attacker. No program has to run, so a machine where the backdoor was blocked could still have leaked a credential.

The vendor's first answer was wrong

ManageEngine's lab flagged the activity on 28 May, when its endpoint software recorded AOMEI Backupper installing Radmin on two unrelated customers in different countries. A customer raised it on 7 June and the lab notified AOMEI the same day.

AOMEI's first explanation was that the content had been intercepted and altered in transit. The lab says the evidence did not support that: both machines fetched the files over HTTPS directly from AOMEI's servers, in different countries on different networks, and in mid-July the lab's own monitoring captured a tampering window as it happened, which showed the change being served from AOMEI's side.

Mandiant notified AOMEI on 17 July. On 29 July AOMEI said corrective action had been taken. As of publication ManageEngine had not independently confirmed the compromise was contained.

Victims were identified across IT services, telecommunications and higher education in eleven countries — Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States — and GTIG describes the targeting as opportunistic and says the real number is likely higher.

This is the second compromise in a fortnight here that turned on identity rather than a flaw, after an npm trusted publishing flow that checked the package name and not the identity behind it.

What to do

• Hunt across April to July 2026 on any machine that ran AOMEI software. A fixed server does not clean a machine that was already hit.
• Look for a scheduled task named RadminComponentRuntime, or NitroRuntime for the follow-on tool, and for an unsigned upgrade-now executable carrying AOMEI publisher details.
• Preserve the cached configuration files in the program's own folders before anything overwrites them, and pull proxy logs for what the server actually served at the moment of any historic alert.
• Reopen closed tickets. If an analyst dismissed an AOMEI detection this year after checking the vendor's site, that check was worthless by design.
• Block outbound SMB and WebDAV to external addresses, which stops the credential trick independently of the backdoor.
• Treat unverified update channels as a procurement question. A product that ships updates with no signature check is one server compromise away from this, whoever makes it.

What is not established

• How the attackers got the ability to change files on AOMEI's servers. Neither report says.
• Which versions of Backupper are affected, or whether any release fixes the verification gap. ManageEngine examined 8.3.0; no fixed version has been named.
• Whether the compromise is contained. AOMEI says it took corrective action; ManageEngine had not confirmed it independently.
• Who UNC7017 is. GTIG names a cluster and no country or motive.
• The full victim count, which GTIG says extends beyond what it identified.
• Whether AnyViewer users were affected. GTIG notes it uses the same update flow, but describes detections involving Backupper.