October 19, 2026: AOMEI, maker of AOMEI Backupper backup software, disclosed that attackers compromised its update servers and injected malware into software downloads. Affected versions between April and July 2026 deployed three malware families: CROSSROAD (downloader), SHINYROAD (persistent backdoor), and Adaptix C2 framework (command & control). Victims include IT services, telecommunications, and higher education organizations across 11 countries. Canonical: aomei-backupper-supply-chain2026. Source: BleepingComputer.
What happened
Between April and July 2026, attackers gained unauthorized access to AOMEI's software update servers and modified unsigned configuration files. These modifications changed the update package checksums and altered pop-up notification behavior. Victims who downloaded AOMEI Backupper during this window received malware-infected copies via the official update mechanism. AOMEI discovered the tampering and acknowledged the compromise on July 29, 2026. The malware remained active even after AOMEI attempted server-side patches, indicating persistence mechanisms were in place.
Technical analysis
Three distinct malware families were deployed: CROSSROAD (downloader that pulled additional payloads), SHINYROAD (persistent backdoor with remote shell access), and Adaptix C2 framework (command-and-control infrastructure). The malware harvested Windows NetNTLMv2 authentication tokens via a hidden WebDAV pop-up prompt, enabling lateral movement within victim networks. Attackers created hidden scheduled tasks and modified startup mechanisms for persistence.
Attack vectors: Compromised AOMEI update servers served as distribution mechanism; unsigned configuration files allowed unrestricted modification; automatic update mechanisms on victim machines deployed malware without user awareness.
Affected organizations: IT services, telecommunications, higher education sectors across United States, Australia, India, Singapore, Spain, Switzerland, and 5 other countries. Confirmed minimum 162+ affected tenants from researcher visibility alone; actual count likely much higher.
Impact
Scope: Unknown total; confirmed 162+ organizations across 11 countries. Supply chain attacks via software updates can affect hundreds of thousands of endpoints globally. AOMEI has millions of users worldwide, so actual impact could be substantially higher.
Risks: Complete system compromise (C2 backdoor access), credential theft (NetNTLMv2 harvesting), lateral network movement, data exfiltration, ransomware deployment, business continuity disruption, domain takeover.
Industry impact: IT services, telecommunications, and higher education sectors face the highest risk because they rely on centralized backup solutions and manage critical infrastructure. Compromised backup software can be weaponized to deploy ransomware across entire organizations or to maintain persistent access for espionage.
This represents a critical supply chain compromise — organizations using AOMEI Backupper during April-July 2026 may have unknowingly deployed attacker-controlled backdoors into their infrastructure and enterprise networks.
What to do
- Update immediately: Download version 3.0.124 or later from AOMEI's official website (not update mechanism if still on compromised version).
- Scan for malware: Run full malware scans on systems that ran affected AOMEI versions (April-July 2026).
- Check for persistence: Look for hidden scheduled tasks, unusual startup entries, or suspicious network connections.
- Monitor network traffic: Check for connections to rank1cdn[.]com (malicious C2 domain) or other suspicious external IPs.
- Review event logs: Check Windows event logs for unauthorized admin account creation or credential-related events during April-July 2026.
- Change credentials: Reset passwords and API keys for critical systems if there's any indication of compromise.
Related reading
See supply chain attack prevention.
Sources
BleepingComputer • The Hacker News • Verified by Google/Mandiant and ManageEngine security labs