AOMEI update servers briefly served CROSSROAD and SHINYROAD malware
Original title: Hackers hijack AOMEI update servers to secretly spread malware
UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.
ManageEngine, Google’s Threat Intelligence Group, and Mandiant say UNC7017 compromised AOMEI delivery infrastructure between April and July 2026. Attackers briefly changed two configuration files so AOMEI Backupper downloaded a malicious archive and executed it through its notification feature. The files installed the CROSSROAD downloader and SHINYROAD backdoor, which used legitimate Radmin components. Exposure windows lasted about 5 to 10 minutes before the originals were restored.
Unconfirmed: The article is cut off before AOMEI’s full response; the scope beyond identified victims is not confirmed.
- Confirmed windows were May 28, July 16, and July 20.
- Victims spanned IT, telecom, and higher education in six countries.
- CROSSROAD persisted with a scheduled task after reconnaissance.
- A July 20 variant tried to steal NTLM hashes via WebDAV.
- ManageEngine notified AOMEI on June 7; AOMEI first blamed transit interception.
Impact: Malware execution and possible NTLM hash theft on Backupper hosts
| Product | Affected |
|---|---|
| AOMEI Backupper | — |
- 1.Check AOMEI Backupper hosts for unexpected Radmin installs, CROSSROAD, or SHINYROAD.
- 2.Review scheduled tasks created after update or notification activity in the exposure windows.
- Vendors
- AOMEI
- Products
- AOMEI BackupperRadmin
- Threat actors
- UNC7017
- Organizations
- ManageEngineGoogle Threat Intelligence GroupMandiant
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | oss-cn-hongkong.aliyuncs | mes used during the attacks, including 8.210.84[.]56 , serv.oss-cn-hongkong[.]aliyuncs.com , hostnames under storage-data[.]com , and storage.go |
| domain | storage-data.com | ]56 , serv.oss-cn-hongkong[.]aliyuncs.com , hostnames under storage-data[.]com , and storage.googleapis.com , a legitimate Google Cloud |
| ipv4 | 8.210.84.56 | addresses and hostnames used during the attacks, including 8.210.84[.]56 , serv.oss-cn-hongkong[.]aliyuncs.com , hostnames under s |
From the original article
5 min read at bleepingcomputer.com
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks. a [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.