Affected Systems

AOMEI Backupper (Windows backup software) users who checked for updates during three brief windows between April and July 2026: May 28 (10 min), July 16 (6 min), July 20 (5 min). Confirmed victims in US, Australia, India, Singapore, Spain, Switzerland across IT services, telecom, and higher education sectors. Actual exposure likely broader due to opportunistic nature.

Exploitation Status

Active exploitation confirmed. Threat actor UNC7017 compromised AOMEI's update infrastructure (www2.aomeisoftware.com and account.aomeitech.com) to distribute CROSSROAD downloader and SHINYROAD backdoor. Attackers modified configuration files (down_html.ini, Notifycfg.ini) for minutes at a time, then restored originals to evade detection. Malware executed without user interaction via built-in promotion system.

Business Impact

Supply chain compromise allowed remote code execution and persistent backdoor installation on systems running AOMEI Backupper. SHINYROAD backdoor uses legitimate Radmin components for C2 communication, enabling follow-on activity. July 20 attack also attempted NTLM hash theft via WebDAV. Detection difficult due to brief exposure windows and file restoration. AOMEI initially disputed findings, claiming transit interception despite HTTPS delivery and evidence from multiple countries. CTO investigation status unknown as of article publication.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Windows endpoints with AOMEI Backupper installed for unexpected Radmin installations, scheduled tasks created by AOMEI processes, and outbound connections to 8.210.84[.]56, serv.oss-cn-hongkong[.]aliyuncs.com, or storage-data[.]com domains between April and July 2026
  • Hunt for CROSSROAD and SHINYROAD indicators in EDR telemetry, focusing on AOMEI Backupper promotion/notification processes (typically ABNotify.exe or similar) spawning unexpected executables or network activity
  • Block network indicators at perimeter: IP 8.210.84[.]56, domains serv.oss-cn-hongkong[.]aliyuncs.com and *.storage-data[.]com; monitor for NTLM authentication attempts to external WebDAV resources
  • Contact AOMEI support for official incident response guidance and verify integrity of current AOMEI Backupper installations; consider temporarily blocking update checks until vendor provides forensic timeline and remediation
  • Review authentication logs for anomalous NTLM hash exposure or lateral movement originating from systems with AOMEI Backupper installed during May-July 2026 timeframe