Security News Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

[Parkinsond]

Content source

https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.

Nothing in the software was exploited. There was no vulnerability, and no user action was needed beyond having the program installed and running, according to ManageEngine's lab. The attacker only had to change two text files on the server for a few minutes.

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers altered AOMEI Backupper update files for 5 to 10 minutes at a time, delivering SHINYROAD to systems that checked for updates

thehackernews.com

 

[Wrecker4923]

Original Reports:

• Report from Google Threat Intelligence
• Report from ManageEngine

The domains are already blocked by x-hagezi-pro.freedns.controld.com and security.cloudflare-dns.com.

An .exe file from May has been flagged by Symantec and McAfee, and a .dll file by Kaspersky.

Andy's Hard_Configurator's recommended settings may be able to block upgrade-now.exe in the software's local directory.

Avast's Hardened Mode may be able to block upgrade-now.exe based on its reputation.

 

[Khushal]

Original Reports:

• Report from Google Threat Intelligence
• Report from ManageEngine

The domains are already blocked by x-hagezi-pro.freedns.controld.com and security.cloudflare-dns.com.

An .exe file from May has been flagged by Symantec and McAfee, and a .dll file by Kaspersky.

Andy's Hard_Configurator's recommended settings may be able to block upgrade-now.exe in the software's local directory.

Avast's Hardened Mode may be able to block upgrade-now.exe based on its reputation.

View attachment 300743View attachment 300744

DAMN ADAPTIX C2 in action! Clearly sophistication was fairly high for this campaign.

 

[Khushal]

Original Reports:

• Report from Google Threat Intelligence
• Report from ManageEngine

The domains are already blocked by x-hagezi-pro.freedns.controld.com and security.cloudflare-dns.com.

An .exe file from May has been flagged by Symantec and McAfee, and a .dll file by Kaspersky.

Andy's Hard_Configurator's recommended settings may be able to block upgrade-now.exe in the software's local directory.

Avast's Hardened Mode may be able to block upgrade-now.exe based on its reputation.

View attachment 300743View attachment 300744

The exe hash is not on KOTIP and so are the other hashes
@harlan4096 these will be uploaded do the needful!