Hackers Hijacked AOMEI Updates for Minutes to Distribute Backdoors
Attackers briefly altered AOMEI update settings between April and July 2026 to push malware, according to Google and Mandiant research.
Key points
- Attackers modified AOMEI update configuration files for short windows between April and July 2026.
- Google and Mandiant attribute the campaign to threat group UNC7017, linked to CROSSROAD and SHINYROAD malware.
- Victims received malicious downloads during brief tampering periods that evaded standard server checks.
Google Threat Intelligence Group and Mandiant reported that attackers hijacked AOMEI software updates to distribute backdoors. The threat group, identified as UNC7017, altered update server configurations for brief periods between April and July 2026, allowing malware to reach users through legitimate update channels.
The operation targeted AOMEI Backupper by modifying two specific configuration files on the vendor’s servers. Attackers changed down_html.ini to redirect downloads and Notifycfg.ini to execute the malware via the program’s notification service. This method bypassed standard security checks because the updates originated from trusted sources.
Campaign Mechanics and Attribution
Analysts tracked the malware chain as CROSSROAD and SHINYROAD. The initial detection came from ManageEngine’s Threat Analysis Lab, which observed suspicious behavior in late May 2026. As Threat Times reported on October 20, 2026, researchers previously detailed how UNC7017 briefly altered server configs to push malware before restoring legitimate content.
The attackers executed three specific tampering windows. They modified settings for ten minutes on May 28, six minutes on July 16, and five minutes on July 20. After each window, the group restored the original configuration files, making subsequent investigations of the live server appear clean.
This approach differs from incidents involving altered software releases or build systems. By targeting the delivery route rather than the software code itself, attackers exploited the trust users place in automatic updates. A Notepad++ update breach serves as another example of this tactic against trusted software distribution channels.
Impact and Persistence
Any AOMEI Backupper computer checking for updates during an active window could receive a malicious download instead of a genuine update. The brief nature of the tampering did not limit the malware’s persistence. Once a system received the altered instructions, it could continue running malicious files even after AOMEI repaired its servers.
Affected organizations were reported across several sectors and countries, including India. The full number of impacted systems remains unknown. In July, attackers directed one download through a public Google Cloud Storage bucket, having previously used Alibaba Cloud storage and domains designed to mimic AOMEI.
What should you do?
Organizations using AOMEI Backupper should review their update logs for any unexpected activity during the identified windows. Security teams should monitor for the presence of CROSSROAD or SHINYROAD malware indicators on their networks. Administrators should verify the integrity of configuration files on their endpoints.
AOMEI stated to Google that it had taken corrective action to secure its distribution servers. However, no specific patch or update for the client software has been confirmed yet. Users should remain vigilant for any official guidance from the vendor regarding remediation steps.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: AOMEI
- Review AOMEI Backupper update logs for any downloads occurring between April and July 2026.
- Scan endpoints for indicators of compromise associated with CROSSROAD and SHINYROAD malware families.
- Verify the integrity of local configuration files such as down_html.ini and Notifycfg.ini.
- Monitor network traffic for connections to known malicious infrastructure or mimicry domains.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attackers distribute the malware?
They altered AOMEI's update server configuration files for short periods, redirecting legitimate update requests to malicious downloads.
Which threat group is responsible?
Google and Mandiant attribute the activity to UNC7017, which is associated with the CROSSROAD and SHINYROAD malware chains.
Is there a fix available?
AOMEI stated it secured its servers, but no confirmed patch or update for the client software has been released yet.
