Google Threat Intelligence Group (GTIG) and Mandiant, working with ManageEngine's Threat Analysis Lab, disclosed on 15 October 2026 that AOMEI Technology's origin update servers for AOMEI Backupper were repeatedly tampered with between April and July 2026.

In confirmed windows on 28 May (10 minutes), 16 July (6 minutes) and 20 July (5 minutes) UTC, attackers briefly changed the unsigned down_html.ini and Notifycfg.ini files that Backupper polls over HTTPS so any client that checked for an update during those minutes downloaded and ran a trojanised package. There was no software vulnerability: the client trusted the MD5 checksum inside the same unsigned configuration file that named the download.

GTIG tracks the cluster as UNC7017. On hit machines a CROSSROAD downloader staged a signed Radmin binary beside an attacker DLL that loaded the SHINYROAD implant (later Adaptix C2 on some hosts), set a scheduled task, and restored the local update file so the machine looked clean while the vendor's download page also looked clean again within minutes. GTIG telemetry spans IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States; victimology is opportunistic.

AOMEI told Mandiant on 29 July that it had secured the servers; ManageEngine said it had not independently confirmed containment as of publication.

Backupper's changelog through 8.5.0 (9 Oct) lists no change to update verification. Primary: Google Cloud / GTIG (15 Oct); vendor analysis: ManageEngine Threat Analysis Lab; wire: The Hacker News (16 Oct).

UPDATE (19 Oct, BleepingComputer): ManageEngine says it first told AOMEI about the suspicious activity on 7 June, when AOMEI suggested the files may have been altered in transit (the researchers disagreed). After capturing the 16 July tampering, ManageEngine sent AOMEI the original and modified files, hashes and differences, advised it to preserve evidence before moving the configuration files to new infrastructure, and put it in touch with Mandiant.

AOMEI told BleepingComputer it is treating the matter as a high priority, that its chief technology officer is leading an internal investigation, and that a more detailed response will follow.

It has not said how the attackers got into its update infrastructure or confirmed that the compromise is fully resolved.

UPDATE (19–20 Oct): AOMEI released Backupper 8.5.1 on 19 October as a security update for the tampering incident. Its changelog says it turns off the in-app entry points for promotional pop-up content and automatic software updates, adds asymmetric encryption to remote configuration files including the .ini files, stops using the old update domain www2.aomeisoftware.com, separates software updates from marketing configuration and download resources, and only accepts update files from official AOMEI websites.

In an email to The Record on 20 October, AOMEI confirmed that attackers repeatedly altered configuration files on its update servers between April and July.

It said its own investigation after ManageEngine's first warning 'rectified some potential vulnerabilities' but could not find the root cause, and that it only found traces of the intrusion in server logs after ManageEngine supplied the exact tampering times in July.

AOMEI said it has not yet identified or notified infected customers, will assess and contact potentially affected users, has released a free detection tool, and saw anomalies only in Backupper, not AnyViewer.

Google said it has notified the victims it identified, and that in the 20 July window the attackers also used an invisible pop-up to make machines send Windows password hashes to an attacker-controlled server, which could work even where the malware itself was blocked. Vendor: AOMEI changelog; wire: The Record (20 Oct).