Hackers hijack AOMEI update servers to secretly spread malware

Hackers compromised AOMEI's update and notification servers for AOMEI Backupper, a Windows backup software, to perform supply chain attacks from April to July 2026. They briefly modified two configuration files (down_html.ini and Notifycfg.ini) to redirect update downloads to malicious ZIP archives and trigger malware execution without user interaction. The malware included CROSSROAD, a downloader that performed reconnaissance and established persistence, and SHINYROAD, a backdoor leveraging legitimate Radmin components for remote command execution. The attackers also attempted to steal Windows NTLM hashes via a notification-triggered WebDAV request. These modifications lasted only minutes, complicating detection. Researchers from ManageEngine, Google, and Mandiant investigated the attacks, attributing them to threat actor UNC7017. AOMEI was notified early and has since taken corrective measures, including server upgrades and patching, though the initial access method remains unclear.

The compromise allowed attackers to distribute malware to users of AOMEI Backupper via legitimate update and notification mechanisms, potentially infecting multiple organizations across various countries and sectors. The malware enabled remote control of infected systems, persistence, and credential theft, posing significant risks to confidentiality, integrity, and availability of affected systems. The brief exposure windows limited the attack's reach but complicated detection and response. The supply chain nature of the attack undermines trust in the software's update process.

AOMEI has upgraded its servers, patched vulnerabilities, and verified the integrity of hosted files, effectively mitigating the threat. Organizations should ensure they are running software versions with updates from AOMEI post-July 2026 and monitor for any signs of compromise related to CROSSROAD or SHINYROAD malware. Since the attack windows were brief and the vendor has taken corrective action, no additional immediate mitigation is required beyond applying vendor updates and following guidance from AOMEI and incident response specialists.