AOMEI Backupper Update Servers Tampered in 5-10 Minute Windows Delivering SHINYROAD Backdoor
Brief server-side file swaps on AOMEI update infrastructure delivered a backdoor to any polling client without exploiting a vulnerability. The campaign's short duration and lack of code signing on control files evaded standard detection. Organizations using AOMEI products should audit update logs and scheduled tasks for indicators of SHINYROAD.
GTIG, Mandiant and ManageEngine's lab traced three confirmed tampering windows totaling under 25 minutes. The attackers replaced down_html.ini and Notifycfg.ini so the checksum verification pointed to attacker-controlled packages. No software vulnerability or user action was required beyond the background update service running on version 8.3.0 and similar releases. Affected organizations spanned IT services, telecom and higher education in eleven countries; telemetry showed opportunistic rather than targeted delivery.
The root cause was absent cryptographic signing on the two control files and reliance on a checksum embedded in the same unsigned file. This allowed server-side file swaps to bypass all client-side checks. The same update mechanism is shared with AOMEI's AnyViewer remote-desktop product, widening the exposure surface. GTIG attributes the activity to UNC7017 without naming a state actor or prior campaigns matching this exact short-window pattern.
The vendor stated it has secured the servers, yet the backdoor persists on already-compromised hosts. CROSSROAD downloader stages a signed Radmin binary alongside a malicious DLL that loads the SHINYROAD implant via scheduled task. Because the attack leaves no persistent server artifact after each window closes, traditional file-scanning and point-in-time triage miss it. Future monitoring must focus on anomalous update-file hashes and scheduled-task anomalies rather than server compromise alone.
Mandiant: At least two additional tampering windows will appear in AOMEI server logs once full May-July access logs are reviewed by December 2026.
Sources (2)
- [1]Google Threat Intelligence Group Report(https://blog.google/threat-analysis-group/unc7017-aomei-2026)
- [2]ManageEngine Threat Analysis Lab Disclosure(https://manageengine.com/threat-analysis/aomei-backdoor-2026)