AOMEI Update Systems Briefly Served Malware in 2026

Hackers reportedly compromised AOMEI’s update and notification systems to distribute malware through a promotional feature in AOMEI Backupper, the company’s Windows backup application. The supply chain attacks took place between April and July 2026, according to reports by ManageEngine and Google.

Researchers from ManageEngine’s Threat Analysis Lab, Google’s Threat Intelligence Group and Mandiant attributed the activity to a threat actor tracked as UNC7017. The attackers used the compromised infrastructure to distribute CROSSROAD, a previously unknown malware downloader, and SHINYROAD, a backdoor.

The researchers identified affected organizations in the United States, Australia, India, Singapore, Spain and Switzerland, across sectors including IT services, telecommunications and higher education. Google said the attacks were opportunistic and may have affected other organizations checking for updates during the exposure periods.

Researchers captured malicious configuration files being served on July 16. They identified three exposure windows: May 28 for 10 minutes, July 16 for 6 minutes and July 20 for 5 minutes. The attackers restored the files within minutes. The modified files redirected Backupper to a malicious ZIP archive and used its notification system to run malware without user interaction. The attackers also changed the expected checksum, allowing the archive to pass file verification.

ManageEngine said it first notified AOMEI on June 7. AOMEI initially suggested the content might have been altered in transit; ManageEngine’s report said the evidence did not support that explanation. The report said the files came over HTTPS from AOMEI-owned hostnames and were altered within the vendor-hosted delivery path.