Aomei Backupper Hack And How To Fix

I have been using Aomei Backupper Pro to take images of my Windows system for over a decade. I know Jim Hillier has also been using this software. In fact, DCT has covered this software frequently over the years and has had many giveaways of it. So, I am sure that many DCT readers use Aomei Backupper. Unfortunately, Aomei recently discovered malware that infected them. Stay tuned for how to upgrade to a fixed version and how to test for and fix the malware.

What Happened?

Hackers hijacked AOMEI update servers between April and July 2026 to distribute malware through AOMEI Backupper.  The threat actor, tracked as UNC7017, briefly tampered with configuration files, redirecting users to malicious downloads. 

The attack delivered CROSSROAD (a downloader) and SHINYROAD (a backdoor) to systems checking for updates during specific windows on May 28, July 16, and July 20.  The malware established persistence via scheduled tasks and used legitimate Radmin executables to load malicious DLLs, while also attempting to steal NTLM hashes via WebDAV.

How To Fix

Aomei has patched its servers and delivered version 8.5.1 of AOMEI Backupper (released October 19, 2026) to block the attack path.  Aomei changed the update server. So the internal check for updates will not work.

On the AOMEI Backupper changelog page, there are two download buttons at the top:

• For Free Users → Standard Edition (free, limited features)
• For Paid Users → Setup Edition (full-featured installer) 

Steps:

Note: I have the paid version, so here are the steps I followed to fix:

1. Click “Download Setup Edition v8.5.1 For Paid Users” — this is the full installer that includes all paid features.
2. Run the downloaded installer.
3. Select Run as administrator.
4. When prompted to uninstall the existing version, click Yes.
5. When asked whether to retain registration information, click Yes — this preserves your license so you don’t need to re-enter your key. 
6. If the registration info wasn’t carried over (e.g., you chose “No” or the old install was corrupted), activate with your existing license key after installation.

Not Done Yet

Upgrading does not remove malware already installed by the UNC7017 attack.  If your system checked for updates during the affected windows (May 28, July 16, or July 20, 2026), you may be infected. Researchers identified two important components:

• CROSSROAD: The downloader used in the infection process.
• SHINYROAD: A backdoor that provided attackers with remote access and the ability to execute commands.

The attack also abused a legitimate remote administration program called Radmin, loading a malicious DLL alongside it.

 Run both Malwarebytes and Microsoft Defender.

Order

1. Download Malwarebytes Free from its official website.
2. Update its malware definitions.
3. Run a full threat scan.
4. Quarantine anything detected.
5. Restart Windows if requested.
6. Run a Microsoft Defender Full Scan.
7. Run Microsoft Defender Offline Scan if infection is suspected.

Bottom Line

Hackers infected the popular Windows imaging program Aomei Backupper. The internal update checker will not work. Aomei has patched its servers, and released version 8.5.1, users will need to manually update to the newer version. The Windows system should then be checked for infection.

—