Cybersecurity
Hackers hijack AOMEI update servers to spread malware
Researchers said attackers briefly altered AOMEI server files between April and July 2026 to push malware through AOMEI Backupper’s update and notification systems, affecting organisations in several countries.
- ManageEngine, Google and Mandiant said the campaign targeted AOMEI Backupper's update and notification systems between April and July 2026.
- Google and ManageEngine attributed the activity to UNC7017 and said it delivered CROSSROAD and SHINYROAD.
- ManageEngine said it first saw the malicious behaviour on 28 May, and the researchers identified brief exposure windows on 28 May, 16 July and 20 July.
- ManageEngine said it notified AOMEI on 7 June, and AOMEI later said its CTO was leading an internal investigation.
Researchers from ManageEngine's Threat Analysis Lab, Google's Threat Intelligence Group and Mandiant said attackers used AOMEI's servers to push malware through AOMEI Backupper between April and July 2026. They said the configuration files were altered only for short periods and then restored, which made the activity difficult to spot.
ManageEngine said its endpoint security software first noticed the issue on 28 May, after AOMEI Backupper installed Radmin at two companies in different countries. When the team tried to recreate the behaviour, it initially saw legitimate downloads from AOMEI's servers instead of anything malicious.
Google and ManageEngine said the attackers changed two configuration files, one that directed update downloads and another that controlled notifications. That let the software fetch a malicious archive and run it without user action, and the attackers also changed the checksum so the archive would pass validation.
The reports attributed the campaign to UNC7017 and said the payloads were CROSSROAD and SHINYROAD, with some infections also trying to collect NTLM hashes through an invisible WebDAV request. ManageEngine said it warned AOMEI on 7 June, and AOMEI later said its CTO was leading an internal investigation and that it had patched its servers.
Named in this story
Companies
- AOMEI
- owned the servers and later said its CTO was leading an internal investigation
- published a report and confirmed parts of the execution flow
- Mandiant
- notified AOMEI about the tampering and assisted with the investigation
Organisations
- ManageEngine's Threat Analysis Lab (METAL)
- helped uncover and track the campaign
- Google's Threat Intelligence Group (GTIG)
- worked with ManageEngine and Mandiant on the investigation
- UNC7017
- was the threat actor named in the reports
Products and systems
- AOMEI Backupper
- was the Windows backup application whose update and notification systems were abused
- CROSSROAD
- was the downloader delivered in the campaign
- SHINYROAD
- was the backdoor delivered in the campaign
- Radmin
- was the legitimate remote administration tool installed during the attacks
Places
- United States
- was one of the countries where affected organisations were identified
- Australia
- was one of the countries where affected organisations were identified
- India
- was one of the countries where affected organisations were identified
- Singapore
- was one of the countries where affected organisations were identified
- Spain
- was one of the countries where affected organisations were identified
- Switzerland
- was one of the countries where affected organisations were identified
How the source tells it
The piece is mostly a straightforward investigative report, though the opening language and closing advice add a mild alarm-and-urgency frame.
- alarm the opening description of hidden malware delivery and the headline-style emphasis on secrecy
- urgency the closing advice on indicators of compromise and the warning that fixing servers would not clean infected machines