Google's threat team says attackers repeatedly swapped the files that AOMEI Backupper uses to check for updates, for a few minutes at a time, so any copy that checked in during those minutes downloaded a backdoor. AOMEI has reported fixing the servers. That does not remove the backdoor from machines that already ran it.
What happened
Google Threat Intelligence Group and Mandiant, working with ManageEngine, say a cluster they track as UNC7017 tampered with AOMEI Technology's update and notification servers between April and July 2026. Each window lasted five to ten minutes, then the genuine files were put back. Confirmed windows were 28 May (10 minutes), 16 July (6 minutes) and 20 July (5 minutes), all UTC. Google says more windows likely went unseen.
The client trusts two unsigned configuration files. One names the update package and the checksum it should match. The other tells a background notifier what to run. During a window, both were pointed at a malicious archive. The downloader, which Google calls CROSSROAD, then set a scheduled task and installed a backdoor framework called SHINYROAD, in some cases beside a modified Radmin remote-admin tool. No software bug was required.
Who is affected
Any Windows system that polled the update servers during a tampering window was eligible. Named victims are a subset.
- PCs and servers running AOMEI Backupper, paid or unpaid, that checked for updates during a tampering window.
- AnyViewer may share the same notification channel. Google did not separately confirm AnyViewer infections.
- Organisations Google identified include IT services, telecommunications and higher education in South Africa, among other countries.
What to do now
Do not treat a clean vendor update as proof the PC is clean. Hunt for the backdoor on any machine that runs AOMEI Backupper.
- List every PC, including technician laptops, that has AOMEI Backupper or AnyViewer installed.
- Look for a scheduled task created around an update check, a Radmin install under the user profile, and unexpected files in the AOMEI html or temp folders.
- If those signs are present, isolate the machine, rotate credentials used on it, and rebuild rather than relying on the vendor server fix.
- Stop treating an unsigned vendor update channel as safe on admin workstations.
What this means for South African businesses
Google named South Africa among the countries where it identified compromised organisations, in IT services, telecommunications and higher education. Because every client that polled during a window was eligible, the real set is wider than the named victims.
Most South African small firms do not run AOMEI as their main backup platform. A disk-clone tool on one technician laptop is still enough to hand an attacker a foothold inside a managed-services shop, and that is the exposure worth checking this week.
Source: SecurityWeek, AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.