GoKawiilAOMEI Backupper update servers hijacked to push malware in 2026 supply-chain attack
Attackers identified as UNC7017 compromised AOMEI's servers between April and July 2026, briefly altering configuration files used by AOMEI Backupper's promotional feature to distribute a new downloader called CROSSROAD and a backdoor called SHINYROAD, then restoring the files to cover their tracks. Researchers from ManageEngine's METAL team, Google's Threat Intelligence Group and Mandiant found affected organizations in the US, Australia, India, Singapore, Spain and Switzerland, spanning IT services, telecoms and higher education.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how a trusted software vendor's routine update and promotional infrastructure can be weaponized to quietly reach many organizations at once, a classic supply-chain risk. Google's warning that the campaign was opportunistic suggests the actual number of affected systems could be larger than those already identified, since any machine checking for updates during the malicious windows was potentially exposed.
- AOMEI Backupper's update/promotion feature was compromised to distribute malware from April to July 2026.
- New malware families CROSSROAD (downloader) and SHINYROAD (backdoor) were deployed via the compromised infrastructure.
- Victims span multiple countries and sectors, and Google warns the true scope may be wider than confirmed cases.
Western Digital My Book Desktop External Hard Drive — With supply chain attacks hitting backup software like AOMEI Backupper, having an offline, air-gapped backup is more important than ever. A dedicated external drive lets you keep local copies of critical data without relying solely on internet-connected update servers that could be compromised. It's a simple, practical layer of defense against ransomware and malware-tainted software updates.
See Western Digital My Book Desktop External Hard Drive on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-19
Published there as: “Hackers hijack AOMEI update servers to secretly spread malware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.