AOMEI Backupper servers hijacked for minutes at a time to push backdoor

Between April and July 2026 attackers performed a stealthy supply-chain compromise of AOMEI Backupper’s update and pop-up mechanism, briefly replacing configuration files on vendor servers to point clients to attacker-controlled payloads; the dropper (CROSSROAD) installed legitimate Radmin plus a backdoor (SHINYROAD), created a recurring task, and in some cases caused machines to leak NetNTLMv2 hashes. The campaign used short tampering windows (confirmed on May 28, July 16, and July 20), affected users across many countries, and was observed and reported by ManageEngine, Google Threat Intelligence, and Mandiant, with AOMEI investigating and issuing mitigations.