Attackers Tampered With AOMEI Update Systems to Deliver Malware
Summary
Researchers say attackers compromised AOMEI's update infrastructure in brief windows from May to July 2026, delivering CROSSROAD and SHINYROAD to Backupper users. AOMEI says it secured its servers, but customer systems may still need remediation.
Key points
- Researchers observed malicious changes to AOMEI Backupper promotion and notification configuration files during brief exposure windows in May and July 2026.
- The altered configuration redirected software to a malicious archive and used the notification system to run it without user interaction; attackers also modified the expected checksum.
- The campaign delivered the CROSSROAD downloader and SHINYROAD backdoor, and attempted to steal Windows authentication hashes via an attacker-controlled WebDAV resource.
- Researchers attributed the activity to UNC7017 and identified affected organizations across multiple countries and sectors; Google warned additional organizations may have been exposed.
- AOMEI said it upgraded servers, patched potential vulnerabilities, and verified hosted files, but did not confirm how attackers gained access or whether the compromise was fully resolved.
- ManageEngine warned that fixing the servers would not remove malware already installed; it advised organizations to check for suspicious scheduled tasks, unexpected files, and connections to attacker infrastructure.
Article Details
- Victim Organization
- AOMEI
- Incident Type
- Supply-chain compromise of AOMEI's update and notification infrastructure to distribute malware through AOMEI Backupper.
- Disclosure Date
- 2026-10-19
- Data Types Exposed
- Windows authentication hashes (potential exposure)
- Operational Impact
- Malicious configuration files were served during three brief exposure windows, potentially causing AOMEI Backupper to install malware on customer computers. The article does not report confirmed service disruption.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | serv[.]oss-cn-hongkong[.]aliyuncs[.]com | Hostname identified by researchers as used during the attacks. |
| DOMAIN | storage-data[.]com | Domain with hostnames identified by researchers as used during the attacks. |
| IPV4 | 8[.]210[.]84[.]56 | IP address identified by researchers as used during the attacks. |
MITRE ATT&CK
Threat Actors
Malware
Vendors
AOMEIHackers hijack AOMEI update servers to secretly spread malwareGoogleResearchers at ManageEngine's Threat Analysis Lab (METAL), working with Google's Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks.ManageEngineResearchers at ManageEngine's Threat Analysis Lab (METAL), working with Google's Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks.MandiantResearchers at ManageEngine's Threat Analysis Lab (METAL), working with Google's Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks.
Products
AOMEI BackupperThe supply chain attacks took place between April and July 2026 and targeted the update and notification systems used by AOMEI Backupper, a Windows application for backing up data, cloning disks, and restoring systems.Radminsecurity software spotted AOMEI Backupper suddenly installing the legitimate remote administration tool Radmin on computers at two unrelated companies in different countries.
Countries
AustraliaThe researchers identified affected organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, andIndiaidentified affected organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higherSingaporeidentified affected organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higher education.Spainaffected organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higher education.Switzerlandin multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higher education.United StatesThe researchers identified affected organizations in multiple countries, including the United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and
Industries
Higher EducationSingapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higher education.IT servicesthe United States, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higher education.TelecommunicationsStates, Australia, India, Singapore, Spain, and Switzerland, across sectors such as IT services, telecommunications, and higher education.