GoKawiilAOMEI Backupper update servers hijacked to push malware in 2026 supply-chain attack
Attackers identified as UNC7017 compromised AOMEI's servers between April and July 2026, briefly altering configuration files used by AOMEI Backupper's promotional feature to distribute a new downloader called CROSSROAD and a backdoor called SHINYROAD, then restoring the files to cover their tracks. Researchers from ManageEngine's METAL team, Google's Threat Intelligence Group and Mandiant found affected organizations in the US, Australia, India, Singapore, Spain and Switzerland, spanning IT services, telecoms and higher education.