A short-lived change to AOMEI’s software update system gave hackers a way to deliver malware through a trusted route.

Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI’s update settings for only a few minutes at a time between April and July 2026.

Any AOMEI Backupper computer checking for updates during an active window could receive a malicious download instead of a genuine update.

The operation did not rely on a software flaw or require users to open a suspicious file. Instead, the attackers changed two configuration files on AOMEI’s servers, redirecting downloads and using the program’s notification feature to run the malware.

Affected organizations were reported across several sectors and countries, including India, though the full number of impacted systems is not known.

Google Cloud’s GTIG and Mandiant analysts tracked the malware chain as CROSSROAD and SHINYROAD and attributed the activity to a threat group they call UNC7017.

The initial activity was first detected through telemetry shared by ManageEngine’s Threat Analysis Lab, which observed suspicious behavior in late May. AOMEI told Google that it had taken corrective action to secure its distribution servers.

Hackers Hijack AOMEI Software Updates

AOMEI’s update process uses down_html.ini to provide a package version, checksum and download location. A separate file, Notifycfg.ini, guides its notification service, including which local programs to run.

During observed tampering periods, attackers changed both files so the software would accept and launch a harmful ZIP archive.

Researchers recorded three specific windows: ten minutes on May 28, six minutes on July 16 and five minutes on July 20. The attackers restored the original settings after each window.

AOMEI Update Mechanism (Source - Google Cloud) — AOMEI Update Mechanism (Source – Google Cloud)

That made ordinary checks of the live update server less useful: an investigation carried out later could see only the clean files.

The method differs from incidents involving altered software releases or build systems; a Notepad++ update breach is another example of attackers targeting the route that delivers trusted software.

The brief windows did not make the malware itself temporary. A computer that received the altered instructions could continue running malicious files after AOMEI’s servers were repaired.

In July, the attackers also directed one download through a public Google Cloud Storage bucket, after earlier use of Alibaba Cloud storage and domains designed to look connected to AOMEI. This changing delivery setup could make simple domain-blocking rules less reliable.

How the malware chain worked

The first-stage program, CROSSROAD, arrived as upgrade-now.exe. It checked aspects of the computer and could download additional files, create a scheduled task and then delete its own copy.

The task launched a legitimate Radmin program every three hours. However, the Radmin process was placed alongside an attacker-created DLL named BlkScrDl.dll, which it loaded during startup.

That DLL helped start SHINYROAD, a backdoor that could communicate with the attackers’ systems. Later activity also involved ADAPTAGENT, a client for the Adaptix command-and-control framework, disguised as Nitro PDF software.

Victim Profiling, Malware Delivery Logic (Source - Google Cloud) — Victim Profiling, Malware Delivery Logic (Source – Google Cloud)

The use of real administration software and familiar product names can make a malicious process harder to distinguish from normal activity.

Other recent incidents, such as the DAEMON Tools malware supply-chain case, show how attackers can abuse trusted software channels to reach users.

On July 20, attackers added a second risk. They used an invisible, one-pixel notification window to make an AOMEI client request a remote file over WebDAV.

That request could prompt Windows to send NetNTLMv2 authentication data to an attacker-controlled server without a visible prompt. This technique is known as credential coercion: the victim’s computer is induced to attempt authentication to a remote location.

AOMEI’s server-side fix does not remove files already installed on affected computers. Organizations using AOMEI software should review endpoint and network records covering the campaign period, paying particular attention to unusual updater child processes, unexpected Radmin or Nitro-related scheduled tasks, and connections to the indicators below.

Analysts should also examine cached AOMEI configuration files and relevant proxy or firewall logs, since the live server may now return legitimate settings.

The incident also highlights a design issue for software vendors: HTTPS and a checksum supplied in an unsigned configuration file are not enough to prove an update is genuine.

Google recommends signed configuration files, cryptographic verification of downloaded files, and strict limits on which domains an updater may contact. Separating promotional pop-ups from update execution can also reduce the risk of one feature being misused to launch code.

The case echoes other short-lived supply-chain incidents, including a LiteLLM package compromise in which malicious releases were available for a limited period.

In both situations, a brief exposure window can still leave behind a longer incident-response task: find affected systems, assess what ran, and investigate whether credentials or other access were exposed.

Indicators of compromise (IoCs):-

Malicious file hashes

File or description	SHA-256
`upgrade-now.zip` — May 20 CROSSROAD archive	`6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7`
`upgrade-now.exe` — May 20 CROSSROAD loader	`11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad`
`upgrade-now.exe` — July 16 CROSSROAD loader	`9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450`
`upgrade-now.exe` — July 20 CROSSROAD loader	`b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21`
`upgrade-now.zip` — July 20 CROSSROAD archive	`9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba`
`component.zip` / `en.zip` — SHINYROAD package	`d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464`
`RuntimeComponent.dll` — PocketPy engine	`8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8`
`BlkScrDl.dll` — malicious DLL	`5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e`
`config.zip` — Python bytecode archive	`4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b`
`metadata.dat` — encrypted payload	`4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431`
`axmlx.` — decoy file	`d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c`
`NitroPromotion.exe` — ADAPTAGENT launcher	`14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591`
`Eztwain4.dll` — ADAPTAGENT helper DLL	`8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4`
`abe.exe` — secondary payload	`7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d`

Other file and configuration hashes

File or description	SHA-256
`WinLpcDl.dll` — legitimate Radmin component	`2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b`
`WinLpcDl2.dll` — legitimate Radmin component	`dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951`
`Nitro_Scan2PDFApp.exe` — legitimate signed binary	`d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd`
`down_html.ini` — tampered July 16	`924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6`
`Notifycfg.ini` — tampered July 16	`d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934`
`Notifycfg.ini` — July 20 WebDAV version	`286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8`
`down_html.ini` — tampered July 20	`f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4`

Network and host indicators

Type	Indicator

Type	Indicator
IP address	`8.210.84.56`
IP address	`8.218.65.184`
IP address	`47.239.60.117`
IP address	`96.126.191.98`
Domain	`promotion.storage-data.com`
Domain	`aomei.storage-data.com`
Domain	`storage-data.com`
Domain	`serv.oss-cn-hongkong.aliyuncs.com`
URL	`https://promotion.storage-data.com/download/abpopup/upgrade-now.zip`
URL	`https://promotion.storage-data[.]com/config/component.zip`
URL	`https://promotion.storage-data.com/config/whitelist.ini`
URL	`https://promotion.storage-data.com/config/en.zip`
URL	`https://storage.googleapis.com/aomeiupdate/upgrade-now.zip`
URL	`https://storage.googleapis.com/aomeiupdate/component.zip`
UNC path	`\\8.210.84.56\DavWWWRoot\campaign\24hour-flash-sale.html`
Scheduled task	`\RadminComponentRuntime`
Scheduled task	`\NitroRuntime`
Mutex	`Global\{F9E6E3C0-E11A-4F85-9944-AF4AD6E05883}`
Shared memory	`Local\963d3c60-d406-4ad6-aa1e-dc8e45061ccf`
User-Agent	`Anyviewer-loader/1.0`
User-Agent	`Anyviewer-ipcheck/1.0`
File paths / names	`%LOCALAPPDATA%\Radmin\`; `%LOCALAPPDATA%\Nitro Pro\`; `%TEMP%\svc*.tmp`; `upgrade-now.zip`; `upgrade-now.exe`; `BlkScrDl.dll`; `Eztwain4.dll`
MD5 values in tampered update settings	`31323E7E738230FA6A8DEEF2B7894666`; `BF73C4391B58CA95220CE3AE03F66DCF`

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors appeared first on Cyber Security News.