Programs for backup and remote access can become an infection channel, even if the applications themselves do not contain vulnerabilities. From April to July 2026, the attackers attacked the AOMEI Technology update infrastructure, replacing the malware download settings for only five to ten minutes, and then returning the original files. This was reported by Google Threat Intelligence Group and Mandiant.
The attack affected the AOMEI Backupper update mechanism and the notification service, which periodically download the settings from the company's servers. The attackers changed the address of the archive download and the verification parameters of the version, sending some users to the controlled resources. Additionally, they changed the notification configuration so that the program automatically runs the downloaded malicious file without action on the part of the user.
The first stage of infection was the CROSSROAD bootloader. He checked the system parameters, downloaded additional components and created a Windows task that ensures the re-run of the malware. The following was SHINYROAD, a hidden remote control tool that allowed commands to be executed on an infected computer. Later, the attackers also used Adaptix components, masking them under the Nitro PDF utilities.
In one wave of the attack, on July 20, criminals engaged another mechanism: an invisible window the size of one pixel forced the computer to access an external WebDAV resource. This could lead to the transmission of network credentials in the form of NTLMv2 hashes. At the same time, the initial download of the malicious archive went through Google Cloud Storage, which made it difficult to block on the grounds of recently registered domains.
The activity was discovered thanks to the telemetry of ManageEngine Threat Analysis Lab in several client environments. According to Google and Mandiant, the potentially affected organizations were in different countries and represented IT, telecommunications and higher education. AOMEI reported fixing issues on update distribution servers, but this does not clear computers infected earlier.
Organizations using AOMEI products are encouraged to check the systems for the period from April to July 2026, study network connection logs, and find suspicious files and tasks related to Radmin and Nitro PDF. Checking only current server settings is not enough: attackers quickly returned the original configurations. To reduce risk, processes run by renewal programs should also be monitored and suspicious network connections blocked.
The attack affected the AOMEI Backupper update mechanism and the notification service, which periodically download the settings from the company's servers. The attackers changed the address of the archive download and the verification parameters of the version, sending some users to the controlled resources. Additionally, they changed the notification configuration so that the program automatically runs the downloaded malicious file without action on the part of the user.
The first stage of infection was the CROSSROAD bootloader. He checked the system parameters, downloaded additional components and created a Windows task that ensures the re-run of the malware. The following was SHINYROAD, a hidden remote control tool that allowed commands to be executed on an infected computer. Later, the attackers also used Adaptix components, masking them under the Nitro PDF utilities.
In one wave of the attack, on July 20, criminals engaged another mechanism: an invisible window the size of one pixel forced the computer to access an external WebDAV resource. This could lead to the transmission of network credentials in the form of NTLMv2 hashes. At the same time, the initial download of the malicious archive went through Google Cloud Storage, which made it difficult to block on the grounds of recently registered domains.
The activity was discovered thanks to the telemetry of ManageEngine Threat Analysis Lab in several client environments. According to Google and Mandiant, the potentially affected organizations were in different countries and represented IT, telecommunications and higher education. AOMEI reported fixing issues on update distribution servers, but this does not clear computers infected earlier.
Organizations using AOMEI products are encouraged to check the systems for the period from April to July 2026, study network connection logs, and find suspicious files and tasks related to Radmin and Nitro PDF. Checking only current server settings is not enough: attackers quickly returned the original configurations. To reduce risk, processes run by renewal programs should also be monitored and suspicious network connections blocked.
