AOMEI Backupper update-channel backdoors: why PCs still need checks

An October 16 report from Google Threat Intelligence Group (GTIG) and Mandiant details how attackers used AOMEI Backupper, a Windows backup and disk-cloning tool, to deliver backdoors during April–July 2026. People who ran it during that period have a reason to review their PCs’ history: the vendor’s reported server fixes cannot remove an earlier infection.

A trusted channel, changed for just a few minutes

The attackers changed update and notification instructions on AOMEI’s own servers, directing applications to a malicious ZIP and triggering execution through the normal update and popup flow. Observed tampering windows lasted five to ten minutes before the original configurations returned. Applications checking during those windows could receive the payload without another user click.

The download could pass its checksum check because the attackers changed both the download address and the expected MD5 checksum in the same unsigned configuration file. Matching that value did not establish that AOMEI had authorized the package. The observed chain used the application’s existing content-handling behavior without needing a memory-corruption exploit.

What remained after the servers looked normal

ManageEngine Threat Analysis Lab (METAL) recorded the execution chain on two unrelated customer endpoints on May 28. Continuous monitoring later captured tampering on July 16, and GTIG and Mandiant observed another brief window on July 20. A later visit to the same server could encounter only legitimate content.

The CROSSROAD downloader established a scheduled task to keep the SHINYROAD backdoor running. The chain abused a legitimate, digitally signed Radmin program to load a malicious DLL. That distinction matters: Radmin itself was not the malware, and its presence alone does not establish infection.

Mandiant notified AOMEI on July 17. AOMEI reported corrective action on July 29.

Review the PC’s history, not just today’s server

Restoring the vendor’s configuration files does not remove payloads already installed on a PC. Organizations that used Backupper or AnyViewer—which GTIG describes as sharing the update and notification flow—should review endpoint and network records across April–July 2026.

An unauthorized RadminComponentRuntime scheduled task or an unsigned upgrade-now.exe in AOMEI’s HTML resource directory warrants investigation; neither is a standalone infection verdict. Preserve cached configuration and staging files, then correlate alerts with network activity at the time. GTIG and Mandiant provide indicators and YARA rules, while METAL supplies Sigma detection rules.

Home users without those records can ask security support for help, providing the product name and when it was used. Installing the latest version, reinstalling or uninstalling the application should not be treated as proof that an earlier infection has been removed.