AOMEI update servers quietly delivered backdoors to customers
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Wednesday, October 21st, 2026.
AOMEI’s server-side delivery path was manipulated in short windows to install malware through its backup software. Between April and July, attackers changed configuration files for five to ten minutes at a time and then restored them, making the activity difficult to catch. Systems checking in during confirmed windows could receive Radmin and the SHINYROAD backdoor. AOMEI Backupper 8.3.0 and later was observed in the campaign, and AOMEI AnyViewer used the same targeted mechanism.
The attack abused a trusted vendor channel instead of asking users to install an obviously unrelated file. Some systems may also have exposed NetNTLMv2 password hashes through a forced authentication attempt, even where malware execution was blocked. For leaders, approved software can still become a delivery path when vendor infrastructure is compromised. For defenders, normal-looking application activity and signed components shouldn’t automatically be treated as safe. Short and intermittent supply-chain attacks can also evade periodic monitoring.
Use the published indicators to hunt AOMEI systems, investigate confirmed matches deeply and reset credentials where forced authentication or malware delivery may have occurred.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
