ATTACKERS tampered with AOMEI Backupper’s update process by altering two text files on the vendor’s update servers, triggering a supply‑chain style backdoor for users who checked for updates during short windows in May and July 2026. The files, down_html.ini and Notifycfg[.]ini, direct the program to download and run an attacker‑supplied package and to display a malicious pop‑up.
The Backupper software does not cryptographically verify these files, and the checksum in the downloaded package is embedded in the same unsigned file that names it. No vulnerability in the software was exploited; the adversary simply modified server text files for a few minutes, and any copy that checked during a window pulled the malicious payload.
Threat researchers from Google Threat Intelligence Group (GTIG) and Mandiant, via ManageEngine’s Threat Analysis Lab, identified three tampering windows across five to ten minutes each: 28 May 2026, 05:40–05:50 UTC; 16 July 2026, 08:33–08:39 UTC; and 20 July 2026, 10:35–10:40 UTC.
The likely reach was broad, affecting organisations in IT services, telecommunications and higher education across 11 countries (Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States).
The implant chain involved CROSSROAD unpacking a bundle into a local Radmin folder, scheduling a task to run every three hours, and loading a SHINYROAD implant alongside a signed Radmin copy; the SHINYROAD/Adaptix C2 framework provided the remote control, with outbound connections to a hard‑coded address. A second July 20 tactic involved an invisible WebDAV link to exfiltrate NetNTLMv2 credentials. UK organisations are urged to hunt across the April–July period and to block the attacker infrastructure and related SMB/WebDAV traffic.