Your backup program checked for an update. For ten minutes, the answer was a backdoor

Ten minutes on 28 May. Six minutes on 16 July. Five minutes on 20 July. Those are the windows Google's Threat Intelligence Group and Mandiant could confirm in which AOMEI Backupper, a popular free backup tool for Windows, served something other than an update to anyone who asked. Their report, published on 16 October, says there were probably more windows they didn't see.

Nobody broke the program. Backupper fetches two small text files from AOMEI's servers: one names the update package and its checksum, the other tells the pop-up service what to show and what to run. The software checks neither file's signature, and the checksum sits inside the same unsigned file it is meant to verify. So the attackers, tracked as UNC7017, edited those files on the vendor's side, waited a few minutes, and put the originals back. A PC that checked for updates in between downloaded a loader called CROSSROAD, which set up a scheduled task running every three hours and then deleted itself. The task starts a genuine, signed copy of the Radmin remote-control tool, which loads a backdoor the researchers call SHINYROAD. Victims were found in 11 countries, including the United States, Spain, Portugal and Switzerland.

AOMEI says its servers were secured on 29 July. That stops new infections. It does nothing for a machine that was caught in May or July, which is why the only honest advice is to look. Open Task Scheduler and search for a task named RadminComponentRuntime or NitroRuntime; neither belongs on a home PC. Check for a Radmin folder under your local application data that you never installed. If you find either, change your passwords from another device and get the machine cleaned. The current Backupper, 8.5.0 from 9 October, still lists no change to how updates are verified.

Tendvane's Safety check lists scheduled tasks and the programs behind them, which is exactly where this one hides; and its own backup copies your Documents, Pictures and Desktop with plain Windows tools that never phone home for an update.