AOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
Organization
ManageEngine
- Mentions · 7d0
- Mentions · 30d8
- All mentions12
- First seenSep 11, 2026
- Last mentioned10d ago
Timeline
12 articles · newest firstAOMEI has not notified customers after update-server malware hijack
Attackers briefly swapped update configs from April to July so Backupper fetched malware, and already infected PCs stay infected.
74
UNC7017 hijacks AOMEI updates for minutes to plant backdoors
Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.
76
UNC7017 hijacked AOMEI updates to install CROSSROAD and SHINYROAD
Five- to ten-minute tampering windows in May and July 2026 exposed organizations in eleven countries without a CVE.
76
AOMEI update servers briefly served CROSSROAD and SHINYROAD malware
UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.
74
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
ManageEngine RCE Flaw Enables SYSTEM Code Execution From Windows Login Screen
Critical RCE flaw in ManageEngine ADSelfService Plus allows unauthenticated SYSTEM-level code execution from the Windows logon screen, requiring physical access.
80
Why security belongs in the network
Sponsored content advocates for embedding security directly into network infrastructure to improve agility and zero-trust enforcement.
15
Critical ManageEngine Flaw Lets Attackers Gain SYSTEM Access Through Windows Login Screen
Critical CVE-2026-74849 in ManageEngine ADSelfService Plus lets unauthenticated attackers execute SYSTEM code via the Windows login screen.
65
12 Best Endpoint Privilege Management (EPM) Tools Compared (2026): Features & Pricing
A 2026 buyer's guide compares 12 endpoint privilege management tools, ranking CyberArk and BeyondTrust as enterprise leaders.
12
Related CVEs
by mentions- Unauthenticated OS Command Injection RCE in ManageEngine ADSelfService Plus GINA Client
Appears with
- Google Threat Intelligence Grouporganization · 8
- AOMEI Backupperproduct · 8
- SHINYROADmalware · 7
- UNC7017threat actor · 7
- CROSSROADmalware · 7
- Mandiantorganization · 6
- Radminproduct · 5
- Zohoorganization · 4
- AnyViewerproduct · 4
- AOMEIvendor · 4
- AOMEI Technologyvendor · 3
- Microsoftvendor · 2
- ManageEnginevendor · 2
- ADSelfService Plusproduct · 2
- Adaptix C2malware · 2
- CyberFOXvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.