Security News Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

[Parkinsond]

Content source

https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.

Nothing in the software was exploited. There was no vulnerability, and no user action was needed beyond having the program installed and running, according to ManageEngine's lab. The attacker only had to change two text files on the server for a few minutes.

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers altered AOMEI Backupper update files for 5 to 10 minutes at a time, delivering SHINYROAD to systems that checked for updates

thehackernews.com

 

[Wrecker4923]

Original Reports:

• Report from Google Threat Intelligence
• Report from ManageEngine

The domains are already blocked by x-hagezi-pro.freedns.controld.com and security.cloudflare-dns.com.

An .exe file from May has been flagged by Symantec and McAfee, and a .dll file by Kaspersky.

Andy's Hard_Configurator's recommended settings may be able to block upgrade-now.exe in the software's local directory.

Avast's Hardened Mode may be able to block upgrade-now.exe based on its reputation.

 

[Khushal]

Original Reports:

• Report from Google Threat Intelligence
• Report from ManageEngine

The domains are already blocked by x-hagezi-pro.freedns.controld.com and security.cloudflare-dns.com.

An .exe file from May has been flagged by Symantec and McAfee, and a .dll file by Kaspersky.

Andy's Hard_Configurator's recommended settings may be able to block upgrade-now.exe in the software's local directory.

Avast's Hardened Mode may be able to block upgrade-now.exe based on its reputation.

View attachment 300743View attachment 300744

DAMN ADAPTIX C2 in action! Clearly sophistication was fairly high for this campaign.

 

[Khushal]

Original Reports:

• Report from Google Threat Intelligence
• Report from ManageEngine

The domains are already blocked by x-hagezi-pro.freedns.controld.com and security.cloudflare-dns.com.

An .exe file from May has been flagged by Symantec and McAfee, and a .dll file by Kaspersky.

Andy's Hard_Configurator's recommended settings may be able to block upgrade-now.exe in the software's local directory.

Avast's Hardened Mode may be able to block upgrade-now.exe based on its reputation.

View attachment 300743View attachment 300744

The exe hash is not on KOTIP and so are the other hashes
@harlan4096 these will be uploaded do the needful!

 

[Khushal]

VirusTotal

VirusTotal

www.virustotal.com

Sadly no detection from ESET for this more detected file

 

[Khushal]

offtopic @Parkinsond but couldn't DM u so typing here:
keygen detected by Avast

VirusTotal

VirusTotal

www.virustotal.com

 

[I Walk MY Way]

AOMEI Backupper if i had AOMEI Backupper on my pc I would take ti outside and set it on fire,​

 

[franz]

AOMEI Backupper if i had AOMEI Backupper on my pc I would take ti outside and set it on fire,​

Why????

 

[I Walk MY Way]

ho i have my reasons, they invlove

AOMEI Backupper and been let down by it twice,​

​

 

[Wrecker4923]

AOMEI Backupper if i had AOMEI Backupper on my pc I would take ti outside and set it on fire,

Why????

AOMEI Backupper and been let down by it twice,

I tried restoring once, but I (or the process) botched the system completely, resulting in a complete reinstallation. I thought it had something to do with BitLocker. I did remove it from my main system altogether since (and no IOCs, as far as I can tell). No restoration it's not a "backup" system.

I'd say a server compromise that leads to a successful supply-chain (update/notification) attack, with no notification from the company and no news until now, is a good reason to consider ditching it. There was a supply-chain attack in the same category involving Notepad++ (FOSS) earlier this year, and they've handled it better since. I can forgive FOSS; a company with a “casual” response is harder to forgive.

P.S. Supply-chain attacks are getting worse, and they’re likely to get worse still with LLM/infostealer-powered attacks (and entities that don’t take their distribution seriously enough). Also, this is really when being an MT member pays off (besides all the tips and entertainment) .