AOMEI Backupper installer supply chain compromise

ManageEngine’s Threat Analysis Lab says its tools saw AOMEI Backupper install Radmin remote administration software on a customer computer on 28 May 2026. A second customer in another country showed the same chain. Together with Google Threat Intelligence Group and Mandiant it traced the cause to the backup program’s own update settings.

Google and Mandiant say attackers changed those settings on the vendor’s servers three times that they saw directly: on 28 May, 16 July and 20 July 2026. Each window lasted 5 to 10 minutes before the files went back to their real versions. Any copy of the program that checked for updates in that time could be sent to attacker files. Google says it is the first time it has met a software supply chain compromise with such short windows.

Google also reports that on 20 July the attackers added a hidden pop-up that could make computers send network login material to a server they controlled. Impacted organizations, it says, were in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States.

This is a compromise of the software supply chain (T1195.002). No flaw in the program was used. Both researchers say the problem is that the update settings files were not cryptographically checked, and that the checksum that should prove a download is genuine sat in the same unsigned file as the download address.

1. During a window, the attacker changed the settings so that the update pointed to a package on attacker-controlled hosting.
2. The backup program fetched the package and ran an unsigned program with AOMEI-looking details, the CROSSROAD downloader.
3. CROSSROAD checked the computer’s location and security tools, installed Radmin software and created a scheduled task that ran every three hours (T1053).
4. The task started the signed Radmin launcher, which loaded a harmful library placed beside it (DLL hijacking, T1574.001). That library started the SHINYROAD backdoor.
5. At the end of each window the settings went back to normal, which Google says makes later checks by the vendor harder.

Attributed by Google Threat Intelligence Group and Mandiant, 15 October 2026: they track the activity as UNC7017, a cluster that is not tied to a named group or country. ManageEngine's Threat Analysis Lab, which first found the activity, uses the same names in its report of 16 October 2026.

No government body has attributed or described these attacks in the sources we opened.

AOMEI has published no security notice that we could find. Its changelog (version 8.5.0 listed on 19 October 2026) and the pages we tried say nothing about the incident. What we know about its reaction comes from the researchers: Google says Mandiant told AOMEI on 17 July and AOMEI replied on 29 July that it had taken corrective action. ManageEngine says that on 7 June AOMEI first explained that the content had been intercepted and changed in transit, which the researchers say the evidence did not support, and that it has not verified AOMEI's fix.

This case is separate from CVE-2026-12780, a local driver flaw in the same product family.

The number of affected computers has not been published. Google says the targeting was opportunistic because every computer that checked for updates in a window was exposed, and that the real reach "likely extends more broadly" than the organizations it saw. ManageEngine says the backdoor could run commands and new code, but it saw no live session. Credential material may have leaked through the pop-up even on computers where the backdoor did not run.

• Researchers: ManageEngine told AOMEI on 7 June 2026. Mandiant told AOMEI on 17 July and shared indicators.
• Vendor: Google says AOMEI replied on 29 July 2026 that it had taken corrective action. AOMEI has published no security notice that we could find.
• Both reports: they warn that fixing the servers does not clean computers that already ran the file, so each one needs checking.