The AOMEI Backupper Update Server Attack

What happened

Attackers changed two configuration files on AOMEI-hosted servers, then put the original files back within minutes. Google reports that each change stayed live for only 5 to 10 minutes. Any client that polled for updates during a window got the bad instructions.

The first file, down_html.ini, tells AOMEI Backupper where to download an update package and which MD5 checksum to expect. On 16 July 2026 it pointed to https://promotion.storage-data.com/download/abpopup/upgrade-now.zip. On 20 July 2026 it pointed to https://storage.googleapis.com/aomeiupdate/upgrade-now.zip. The attackers also changed the expected checksum, so the bad archive passed the check.

The second file, Notifycfg.ini, controls the notification popups that ABNotify.exe shows. On 16 July Google saw more than 35,000 lines of [dummy_XXXXXX] sections added to it. Google reports that this forced an update whatever version was installed. On 20 July the attackers replaced a sale banner with a 1x1 popup. It pointed at file://8.210.84.56/DavWWWRoot/campaign/24hour-flash-sale.html. Google describes this as an attempt to collect Windows NTLM credentials over WebDAV.

The downloaded upgrade-now.exe is CROSSROAD. Google reports that it checks that its path contains AOMEI, checks the country of the machine, and puts back the clean down_html.ini. It then downloads component.zip, unpacks it to %LOCALAPPDATA%\Radmin\ and creates the scheduled task RadminComponentRuntime. That task runs FamItrfc.exe --runtimechk every three hours. CROSSROAD then deletes itself.

The second stage is SHINYROAD, a backdoor inside a trojanized Famatech Radmin 3.x bundle. The signed FamItrfc.exe loads the attacker DLL BlkScrDl.dll. SHINYROAD decrypts metadata.dat with ChaCha20 and runs it in an embedded PocketPy interpreter. METAL reports a command server at 8[.]218[.]65[.]184:41397. Google lists the same IP on ports 41397 and 443.

On 28 May 2026, METAL saw AOMEI Backupper install Radmin on two unrelated companies in different countries. Google gives that window as 05:40 to 05:50 UTC. In mid-July 2026, Google also saw a second backdoor, ADAPTAGENT, disguised as Nitro PDF tools. It beacons to 8.210.84.56:6800.

Google lists victims in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. The sectors are IT services, telecommunications and higher education. Google says the victim pool is likely broader.

METAL notified AOMEI on 7 June 2026. Mandiant notified AOMEI on 17 July 2026. AOMEI replied on 29 July 2026 that it took corrective action on its distribution servers. METAL reports that AOMEI first said the content was intercepted in transit. METAL says its evidence shows the content changed inside the vendor-hosted delivery path. BleepingComputer reports that AOMEI did not confirm how the attackers got access.

Affected versions

No source gives a full list of affected versions. The sources name the products, the update flow and the dates.

• AOMEI Backupper. METAL observed it on v8.3.0 and later. Google reports that the tampered configuration files reference major version 8, minor version 2.
• AOMEI AnyViewer, which uses the same ABMarket update flow, according to Google.
• Any of these machines that polled for updates during a tampering window between April and July 2026.

Google gives these windows in UTC:

• 28 May 2026, 05:40 to 05:50
• 16 July 2026, 08:33 to 08:39
• 20 July 2026, 10:35 to 10:40

Google reports activity between April and July 2026, with related malware samples from late April. Google says that more tampering windows probably happened outside its view.

Indicators of compromise

These come from Google and METAL. Google publishes the full list in its report.

• Scheduled tasks \RadminComponentRuntime and \NitroRuntime
• Folders %LOCALAPPDATA%\Radmin\ and %LOCALAPPDATA%\Nitro Pro\
• Files BlkScrDl.dll, csvc\RuntimeComponent.dll, config.zip and metadata.dat in the Radmin folder
• upgrade-now.exe or upgrade-now.zip in the AOMEI Tmphtml\ or html\ folders
• Product string AOMEI Update Compent, with the typo that Google reports
• Mutex Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}
• User-Agent Anyviewer-loader/1.0 in proxy logs
• Domains promotion.storage-data.com, aomei.storage-data.com, storage-data.com and serv.oss-cn-hongkong.aliyuncs.com. METAL writes the staging host as promotion[.]storagedata[.]com, without the hyphen.
• IP addresses 8.210.84.56, 8.218.65.184 and 47.239.60.117
• IP address 96.126.191.98, which Google lists as an allowlist entry in whitelist.ini on promotion.storage-data.com
• Google SHA-256, upgrade-now.exe (May 20): 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad
• Google SHA-256, upgrade-now.exe (July 16): 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450
• Google SHA-256, upgrade-now.exe (July 20): b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21
• METAL SHA-256, upgrade-now.exe (28 May endpoint): 130c3970f1c900191615b99d8be522d6a488a3d3b73938896ed937092007d96a
• SHA-256, component.zip: d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464
• SHA-256, BlkScrDl.dll: 5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e
• Google SHA-256, RuntimeComponent.dll: 8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8
• Google SHA-256, NitroPromotion.exe: 14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591

How to check

You can look for the scheduled tasks, the Radmin folder and the dropper on a Windows machine with AOMEI software. These commands only read the disk.

Get-ScheduledTask -TaskName RadminComponentRuntime,NitroRuntime -ErrorAction SilentlyContinue

Get-ChildItem "$env:LOCALAPPDATA\Radmin","$env:LOCALAPPDATA\Nitro Pro" -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256

Get-ChildItem "${env:ProgramFiles(x86)}\AOMEI" -Recurse -Include upgrade-now.exe,upgrade-now.zip -ErrorAction SilentlyContinue

If any command returns a result, compare the hashes to the list above. A clean result today does not prove the machine was clean. Google reports that CROSSROAD deletes itself and hides its file stream. Search proxy and firewall logs from April to July 2026 for the domains and IP addresses above.

What to do now

1. If you find a scheduled task, a file or a hash from the list, isolate the machine from the network.
2. Keep the cached Tmphtml configuration files. Google reports that AOMEI now serves clean files, so a live check of the update URL proves nothing.
3. Search your logs from April to July 2026 for the domains, IP addresses and the Anyviewer-loader/1.0 User-Agent.
4. Block outbound traffic to the domains and IP addresses above.
5. Block outbound SMB on TCP 445 and WebDAV to outside addresses. This stops the NTLM credential trap from the 20 July window.
6. Treat Windows credentials on an affected machine as exposed and change them.
7. Rebuild an affected machine. METAL reports that the server fix stops new infections but does not remove backdoors already installed.

What Vigilance would show (rebuilt from public reports)

Vigilance compares the version you trust with the new one and names the file that gained a new power. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 79

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    upgrade-now.exe
           It now downloads from the internet and runs other programs. It did not before.

Sources

1. cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering
2. manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html
3. bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/