Science & Tech · Cybersecurity · 2 hrs ago
Hackers used brief AOMEI Backupper server tampering to spread malware
Hackers tampered with AOMEI Backupper’s servers between April and July 2026 to send malware to some users of the Windows backup software.
They briefly changed configuration files used by its update and promotional systems, then restored them, making the activity harder to spot.
The changes redirected downloads and triggered malware without user action, according to researchers from ManageEngine, Google and Mandiant.
Researchers identified three exposure windows in May and July, lasting five to ten minutes each.
The campaign delivered a downloader and a backdoor, which could let attackers run further commands on infected computers.
A separate technique also attempted to steal Windows authentication hashes.
Organizations in several countries and sectors were found compromised, including in higher education, IT services and telecommunications, though researchers said other users may also have been affected.
The investigation established how the attacks worked, but no further action or next steps were specified.
Hackers tampered with AOMEI Backupper’s update and notification systems between April and July 2026 to distribute malware.
The short-lived changes redirected the software to malicious downloads and then were reversed, making the activity difficult to detect.
Researchers attributed the campaign to a threat actor tracked as UNC7017 and identified affected organizations in several countries.
AOMEI said it had not identified or notified customers who may have been infected.
Google and ManageEngine warned that fixing AOMEI’s servers would not remove malware from computers already affected.
- Who
- A threat actor tracked as UNC7017 carried out the tampering. Affected organizations included entities in IT services, telecommunications, and higher education.
- What
- Hackers altered AOMEI Backupper’s update and notification settings to distribute malware, including CrossRoad and ShinyRoad.
- When
- Between April and July 2026, in brief windows lasting minutes.
- Where
- AOMEI’s update servers and computers that fetched modified software packages. Researchers identified affected organizations in multiple countries.
- Why
- The attackers used the compromised systems to deliver malware. Their motive is not stated.
AOMEI
ManageEngine and Google
Incident response
AOMEI
AOMEI said it updated its server and found no further traces of malicious files.
ManageEngine and Google
ManageEngine said it had not independently verified that attackers had lost access to AOMEI’s infrastructure.
ManageEngine detected suspicious activity involving AOMEI Backupper at two customers.
ManageEngine’s monitoring captured malicious changes to files served by AOMEI.
Google observed a brief tampering window and a technique that attempted to collect Windows authentication hashes.
AOMEI said it updated its server after researchers provided the specific timing of the tampering.
- Threat actor
- UNC7017
- Campaign period
- April–July 2026
- First detected
- May 28, 2026
- Observed exposure windows
- May 28, July 16, and July 20
- Malware
- CrossRoad downloader and ShinyRoad backdoor
- Affected sectors
- IT services, telecommunications, and higher education
3 sources
What people are saying
Given the short duration of these windows, it is probable that additional tampering occurred throughout the campaign that remained outside our visibility.
Nothing in AOMEI Backupper was exploited,
For an operator who wants to go unnoticed, a backup vendor’s update channel is close to perfect cover.
Each tampering window remained active for only five to ten minutes before reverting to authentic versions