AOMEI Backupper servers tampered with to deliver backdoor

Attackers successfully executed a highly targeted supply chain attack by tampering with the update servers of AOMEI Backupper, a Windows backup and disk-cloning software developed by Hong Kong-based AOMEI Technology. Between May and July 2026, attackers manipulated two unsigned text files on the vendor's servers during brief windows lasting only five to ten minutes.

By altering these files, attackers were able to direct the software to download and execute a backdoor instead of legitimate updates. Because the software did not cryptographically verify the update instructions or the checksums, the malicious package was installed with the privileges of the AOMEI process. This allowed for system-wide software installation on affected machines.

Security researchers from Google Threat Intelligence Group, Mandiant, and ManageEngine’s Threat Analysis Lab identified three specific tampering windows. While AOMEI has reported fixing its servers, the backdoor remains on machines that were compromised during the windows of activity. The malicious payload, identified as SHINYROAD, utilized a downloader to establish persistence on infected systems.