AOMEI update servers were hijacked for minutes at a time to push malware

AOMEI update servers were hijacked for minutes at a time to push malware

15 October 2026: Attackers repeatedly tampered with the update servers behind AOMEI Backupper and AnyViewer between April and July 2026, Google's Threat Intelligence Group and Mandiant report, pushing malware to every client that checked for updates during windows of five to ten minutes and then restoring the genuine files. Organisations that ran either product in that period need to hunt for infections themselves, because the vendor's server-side fix does not clean endpoints.

Not yet independently verified. We found no advisory from AOMEI itself; its response is known only from Google's report and BleepingComputer, and no affected version numbers have been published. We will update this when it can be confirmed, and remove this note.

How the tampering worked

Both products poll two configuration files over HTTPS: one gives the version, the MD5 hash and the download address of the next update, and the other tells the local notification process what to display and run. During each window, the group Google tracks as UNC7017 edited both files, raising the build number and swapping in the hash of its own ZIP archive so clients would accept it, and pointing the download at its own servers. On 16 July it padded the notification file with more than 35,000 lines to force an update whatever version was installed.

The confirmed windows were 28 May (05:40 to 05:50 UTC), 16 July (08:33 to 08:39) and 20 July (10:35 to 10:40), with malware samples seen from late April; Google says further windows probably went unseen. The payload chain starts with a downloader Google calls CROSSROAD, which sets a scheduled task and installs a backdoor framework called SHINYROAD through modified copies of the Radmin remote administration tool, with the Adaptix command-and-control framework used from July. On 20 July the attackers also used an invisible one-pixel popup to make clients connect to a WebDAV share, leaking NetNTLMv2 hashes.

Who was hit

Google says victims included IT services, telecoms and higher education organisations in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States, but that any system polling during a window was exposed. ManageEngine's threat lab first spotted the activity in late May. Mandiant told AOMEI on 17 July, and AOMEI replied on 29 July that corrective action had been taken.

What to hunt for

Google's advice is blunt: organisations "cannot assume they are protected solely because the vendor took corrective server-side action." It recommends:

• blocking storage-data.com and its subdomains and the IP addresses 8.210.84.56, 47.239.60.117 and 8.218.65.184;
• blocking outbound SMB (TCP 445) and WebDAV to the internet;
• searching for the scheduled tasks RadminComponentRuntime and NitroRuntime and unsigned DLLs in the AOMEI program folders;
• running the hunt back over the whole April to July period, and watching for unsigned child processes started by update services.

Sources

• Google Threat Intelligence Group: Investigating ephemeral supply chain tampering, 15 October 2026
• BleepingComputer: Hackers hijack AOMEI update servers to secretly spread malware, 19 October 2026