Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors

A short-lived change to AOMEI’s software update system gave hackers a way to deliver malware through a trusted route.

Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI’s update settings for only a few minutes at a time between April and July 2026.

Any AOMEI Backupper computer checking for updates during an active window could receive a malicious download instead of a genuine update.

The operation did not rely on a software flaw or require users to open a suspicious file. Instead, the attackers changed two configuration files on AOMEI’s servers, redirecting downloads and using the program’s notification feature to run the malware.

Affected organizations were reported across several sectors and countries, including India, though the full number of impacted systems is not known.

Google Cloud’s GTIG and Mandiant analysts tracked the malware chain as CROSSROAD and SHINYROAD and attributed the activity to a threat group they call UNC7017.

The initial activity was first detected through telemetry shared by ManageEngine’s Threat Analysis Lab, which observed suspicious behavior in late May. AOMEI told Google that it had taken corrective action to secure its distribution servers.

Hackers Hijack AOMEI Software Updates

AOMEI’s update process uses down_html.ini to provide a package version, checksum and download location. A separate file, Notifycfg.ini, guides its notification service, including which local programs to run.

During observed tampering periods, attackers changed both files so the software would accept and launch a harmful ZIP archive.

Researchers recorded three specific windows: ten minutes on May 28, six minutes on July 16 and five minutes on July 20. The attackers restored the original settings after each window.

That made ordinary checks of the live update server less useful: an investigation carried out later could see only the clean files.

The method differs from incidents involving altered software releases or build systems; a Notepad++ update breach is another example of attackers targeting the route that delivers trusted software.

The brief windows did not make the malware itself temporary. A computer that received the altered instructions could continue running malicious files after AOMEI’s servers were repaired.

In July, the attackers also directed one download through a public Google Cloud Storage bucket, after earlier use of Alibaba Cloud storage and domains designed to look connected to AOMEI. This changing delivery setup could make simple domain-blocking rules less reliable.

How the malware chain worked

The first-stage program, CROSSROAD, arrived as upgrade-now.exe. It checked aspects of the computer and could download additional files, create a scheduled task and then delete its own copy.

The task launched a legitimate Radmin program every three hours. However, the Radmin process was placed alongside an attacker-created DLL named BlkScrDl.dll, which it loaded during startup.

That DLL helped start SHINYROAD, a backdoor that could communicate with the attackers’ systems. Later activity also involved ADAPTAGENT, a client for the Adaptix command-and-control framework, disguised as Nitro PDF software.

The use of real administration software and familiar product names can make a malicious process harder to distinguish from normal activity.

Other recent incidents, such as the DAEMON Tools malware supply-chain case, show how attackers can abuse trusted software channels to reach users.

On July 20, attackers added a second risk. They used an invisible, one-pixel notification window to make an AOMEI client request a remote file over WebDAV.

That request could prompt Windows to send NetNTLMv2 authentication data to an attacker-controlled server without a visible prompt. This technique is known as credential coercion: the victim’s computer is induced to attempt authentication to a remote location.

AOMEI’s server-side fix does not remove files already installed on affected computers. Organizations using AOMEI software should review endpoint and network records covering the campaign period, paying particular attention to unusual updater child processes, unexpected Radmin or Nitro-related scheduled tasks, and connections to the indicators below.

Analysts should also examine cached AOMEI configuration files and relevant proxy or firewall logs, since the live server may now return legitimate settings.

The incident also highlights a design issue for software vendors: HTTPS and a checksum supplied in an unsigned configuration file are not enough to prove an update is genuine.

Google recommends signed configuration files, cryptographic verification of downloaded files, and strict limits on which domains an updater may contact. Separating promotional pop-ups from update execution can also reduce the risk of one feature being misused to launch code.

The case echoes other short-lived supply-chain incidents, including a LiteLLM package compromise in which malicious releases were available for a limited period.

In both situations, a brief exposure window can still leave behind a longer incident-response task: find affected systems, assess what ran, and investigate whether credentials or other access were exposed.

Indicators of compromise (IoCs):-

Malicious file hashes

File or description	SHA-256
upgrade-now.zip — May 20 CROSSROAD archive	6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7
upgrade-now.exe — May 20 CROSSROAD loader	11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad
upgrade-now.exe — July 16 CROSSROAD loader	9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450
upgrade-now.exe — July 20 CROSSROAD loader	b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21
upgrade-now.zip — July 20 CROSSROAD archive	9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba
component.zip / en.zip — SHINYROAD package	d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464
RuntimeComponent.dll — PocketPy engine	8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8
BlkScrDl.dll — malicious DLL	5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e
config.zip — Python bytecode archive	4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b
metadata.dat — encrypted payload	4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431
axmlx. — decoy file	d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c
NitroPromotion.exe — ADAPTAGENT launcher	14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591
Eztwain4.dll — ADAPTAGENT helper DLL	8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4
abe.exe — secondary payload	7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d

Other file and configuration hashes

File or description	SHA-256
WinLpcDl.dll — legitimate Radmin component	2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b
WinLpcDl2.dll — legitimate Radmin component	dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951
Nitro_Scan2PDFApp.exe — legitimate signed binary	d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd
down_html.ini — tampered July 16	924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6
Notifycfg.ini — tampered July 16	d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934
Notifycfg.ini — July 20 WebDAV version	286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8
down_html.ini — tampered July 20	f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4

Network and host indicators

Type	Indicator

Type	Indicator
IP address	8.210.84.56
IP address	8.218.65.184
IP address	47.239.60.117
IP address	96.126.191.98
Domain	promotion.storage-data.com
Domain	aomei.storage-data.com
Domain	storage-data.com
Domain	serv.oss-cn-hongkong.aliyuncs.com
URL	https://promotion.storage-data.com/download/abpopup/upgrade-now.zip
URL	https://promotion.storage-data[.]com/config/component.zip
URL	https://promotion.storage-data.com/config/whitelist.ini
URL	https://promotion.storage-data.com/config/en.zip
URL	https://storage.googleapis.com/aomeiupdate/upgrade-now.zip
URL	https://storage.googleapis.com/aomeiupdate/component.zip
UNC path	\8.210.84.56DavWWWRootcampaign24hour-flash-sale.html
Scheduled task	RadminComponentRuntime
Scheduled task	NitroRuntime
Mutex	Global{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}
Shared memory	Local963d3c60-d406-4ad6-aa1e-dc8e45061ccf
User-Agent	Anyviewer-loader/1.0
User-Agent	Anyviewer-ipcheck/1.0
File paths / names	%LOCALAPPDATA%Radmin; %LOCALAPPDATA%Nitro Pro; %TEMP%svc*.tmp; upgrade-now.zip; upgrade-now.exe; BlkScrDl.dll; Eztwain4.dll
MD5 values in tampered update settings	31323E7E738230FA6A8DEEF2B7894666; BF73C4391B58CA95220CE3AE03F66DCF

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors appeared first on Cyber Security News.