AOMEI Backupper is backup software, the kind of tool procured once, configured once, and then forgotten, because forgetting about it is the point. Between April and July 2026, attackers altered two configuration files on AOMEI’s own update servers, down_html.ini, which tells the software where to download updates and what checksum to expect, and Notifycfg.ini, which controls the pop-up notifications that can trigger code execution. They supplied a matching checksum so the malicious package passed verification, then restored the original files within minutes. Confirmed tampering lasted roughly ten minutes on 28 May, six minutes on 16 July, and five minutes on 20 July. Any copy of the software checking for updates during one of those windows received a dropper called CROSSROAD, which in turn installed a legitimate remote access tool, Radmin, alongside a backdoor named SHINYROAD. On 20 July, a fourth technique tried to steal Windows password hashes by forcing machines to authenticate to an attacker controlled server, no malware required.
The Vendor Didn’t Believe Its Own Customers
ManageEngine’s endpoint detection software flagged the Radmin installation at two unrelated customers on 28 May. A customer raised the alert on 7 June, and ManageEngine told AOMEI that same day. AOMEI’s own account of what happened next is the part worth sitting with. It initially said the content had been intercepted and altered in transit, not on its own servers. ManageEngine disputed this, and said the evidence pointed to the vendor’s own delivery path. AOMEI investigated, said it had patched unspecified vulnerabilities, and could not identify a root cause. The attackers struck twice more, on 16 July and 20 July, while AOMEI believed the matter was closed. AOMEI only found traces of the intrusion after Mandiant and ManageEngine handed it the exact timestamps of the July windows. As of the most recent reporting, AOMEI had not identified or notified the customers whose machines were compromised.
This Is Not a Cybersecurity Story First
Treat this as an availability incident and the lesson is patch management. Treat it as what it actually is, a vendor trust failure in a category of software built entirely on trust, and the lesson changes. Backup software exists to be the thing an organisation reaches for when everything else has gone wrong. It runs with elevated privileges, it phones home for updates by design, and it rarely gets the scrutiny applied to software that actually touches customer data, precisely because it sits one layer removed from the systems everyone assumes carry the real risk. A PMO that tracks vendor risk at the point of procurement and never again has already missed where this incident happened. AOMEI was told directly, in June, that its update path had been compromised, and still could not confirm the problem was fixed before it recurred in July.
What a Governance Review Should Actually Ask
The question for any PMO or transformation office is not whether an organisation runs backup software from a reputable vendor. Every organisation does. The question is who owns the relationship with that vendor once the contract is signed, and whether that owner has a standing channel to hear about an incident like this one within days rather than months. Three things are worth checking this week. Does the vendor risk register include infrastructure tools that run with elevated privileges but rarely get named in a security review. Does the incident response plan assume a vendor will report promptly when its own update mechanism fails. Has anyone asked the backup vendor directly, this year, how it verifies the integrity of what it pushes to company machines.
The Software You Forgot About Is Watching Your Network Right Now
AOMEI has released a free detection tool and is urging customers to update and scan. That response arrived months after the first warning, and only after outside threat intelligence teams handed the vendor the exact minute its own servers were compromised. Pick the vendor in your own environment that nobody has reviewed since the contract was signed. Name who owns that relationship now, and ask whether they would know within a week if it failed the way AOMEI’s did.