UNC7017 turned AOMEI Backupper updates into malware delivery
ManageEngine’s Threat Analysis Lab, Google Threat Intelligence Group and Mandiant uncovered UNC7017 compromising AOMEI Backupper’s update and notification infrastructure from April through July 2026 to deliver CROSSROAD and SHINYROAD.
The attackers briefly changed two server-side configuration files: one directed Backupper to download packages, while the other controlled notifications and could trigger content to run. The changes sent the software to a malicious ZIP and used its notification feature to run malware without user interaction. The attackers then restored the original files, so later attempts to reproduce the activity found a clean configuration.
Google said the activity was opportunistic and may have reached organizations beyond those identified if they checked for updates during the distribution windows. For teams using Backupper, a clean-looking installation or restored vendor configuration does not establish that the system missed the compromised delivery path.
Hackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a