Cybersecurity researchers at Google Threat Intelligence Group (GTIG) and Mandiant have uncovered a supply chain attack targeting AOMEI Backupper, a popular Windows backup and recovery software application. Hackers compromised the software’s update infrastructure to distribute malicious files to unsuspecting users, potentially allowing attackers to gain unauthorized access to affected computers.
According to researchers, the attackers manipulated AOMEI Backupper’s update configuration files for short periods lasting approximately five to ten minutes. This technique allowed malicious software to be delivered through the application’s legitimate update process while making the activity more difficult to detect. The campaign reportedly took place between April and July 2026, affecting organizations across 11 countries, including the United States.
The attack involved two malicious components identified as CROSSROAD and SHINYROAD. These tools were designed to establish persistent access to compromised Windows systems and allow attackers to execute commands remotely. By exploiting a trusted software update mechanism, the attackers could bypass some traditional security defenses that rely on identifying suspicious downloads or unfamiliar software sources.
Researchers discovered that the attackers used brief windows of malicious activity to reduce their exposure and complicate forensic investigations. Rather than continuously hosting malicious updates, the threat actors temporarily redirected the update process before restoring legitimate configurations. This approach highlights the growing sophistication of software supply chain attacks and the risks associated with compromised third-party applications.
AOMEI reportedly implemented corrective measures after the incident was identified. However, organizations that installed compromised updates may still face security risks if malicious components remain on their systems. Security administrators are encouraged to review endpoint detection alerts, inspect suspicious scheduled tasks, monitor unusual outbound network connections, and investigate unexpected executables associated with the backup software.
The incident underscores the importance of securing software distribution infrastructure and monitoring trusted applications for abnormal behavior. Organizations using AOMEI Backupper should verify their software installations, review available security guidance, and ensure endpoint protection tools are capable of detecting malicious activity originating from legitimate update processes.