Researchers say hackers hijacked AOMEI update servers to spread malware

Hackers reportedly compromised AOMEI's servers to deliver malware through AOMEI Backupper, briefly tampering with configuration files before restoring them to hide the attacks, according to reports from Google and ManageEngine covered by BleepingComputer. The attacks took place between April and July 2026, with confirmed exposure windows on May 28, July 16 and July 20.

Two configuration files were altered for minutes at a time.
The attackers modified down_html.ini, which tells AOMEI Backupper where to download update packages, and Notifycfg.ini, which controls notifications. That redirected the software to a malicious ZIP archive and used the notification mechanism to run it without user interaction. They also changed the expected checksum so the archive passed verification. Researchers identified three exposure windows: 10 minutes on May 28, 6 minutes on July 16 and 5 minutes on July 20, all UTC.

The campaign is attributed to UNC7017.
ManageEngine's Threat Analysis Lab, working with Google Threat Intelligence Group and Mandiant, found the activity. The attackers installed a previously unknown downloader called CROSSROAD and a backdoor called SHINYROAD, which used legitimate Radmin components to load malicious code and connect to an attacker-controlled server. Affected organizations were found in the United States, Australia, India, Singapore, Spain and Switzerland. Google said the attacks were opportunistic and could have hit other organizations that checked for updates during those windows.

The July 20 attack also tried to steal Windows hashes.
Google observed the notification system being forced to access an attacker-controlled WebDAV resource through an invisible popup, which could expose NTLM hashes.

AOMEI says its CTO is leading an investigation.

ManageEngine said it first notified AOMEI on June 7. AOMEI later said it upgraded its servers and patched potential vulnerabilities. ManageEngine warned that a server-side fix does not remove backdoors already installed. Organizations using AOMEI Backupper should review the indicators of compromise published by Google and ManageEngine.