Between May and July 2026, attackers managed to alter the files that AOMEI Backupper, a Windows backup program, downloads from its update servers. This manipulation, occurring in brief five to ten-minute intervals, was aimed at delivering a backdoor to any system checking for updates during those windows. AOMEI Technology, the Hong Kong-based company behind the software, claims to have secured its servers, but this fix does not remove the backdoor from systems already affected.

The attack was disclosed by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab. AOMEI Backupper, alongside AnyViewer, AOMEI's remote-desktop tool, periodically checks for updates via HTTPS. During the attack, two key files, down_html.ini and Notifycfg.ini, were modified. These files dictate which update package to download and what notifications to display, but they lack cryptographic verification, making them vulnerable.

The attackers exploited this by simply changing these files on the server. No vulnerability within the software itself was exploited, nor any user action required beyond having the program running. Affected systems unknowingly installed the attacker's package, which operated with the privileges of the AOMEI process.

The attackers targeted organizations in sectors like IT services, telecommunications, and higher education across 11 countries, including the United States and India. The attack, identified by GTIG as the work of UNC7017, involved a downloader named CROSSROAD and an implant called SHINYROAD, which allowed remote control over compromised systems.

The attack was sophisticated enough to evade traditional detection methods, and GTIG's telemetry suggests more incidents likely occurred than those confirmed. Although AOMEI claims to have fixed the server issue, the persistence of the backdoor means organizations using AOMEI software should actively investigate for potential infections from the April-to-July period.