Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Hackers Hijack AOMEI Backupper Updates to Deploy Backdoors

7 sources · 7 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

UNC7017 tampered with AOMEI update servers in 5-10 minute windows to deliver malware to Backupper users between April and July 2026.

Between April and July 2026, UNC7017 compromised AOMEI's update infrastructure and briefly altered configuration files, redirecting Backupper clients to malicious archives. During confirmed windows on May 28, July 16, and July 20, clients downloaded the CROSSROAD downloader, which installed the SHINYROAD backdoor using legitimate Radmin components and scheduled tasks. Later variants included WebDAV-based NetNTLMv2 theft and Adaptix C2 tooling. The chain affected IT, telecom, and higher education sectors in multiple countries without exploiting software flaws.

Key facts
  • Tampering windows: May 28, July 16, July 20 2026 (5-10 min each)
  • Malware: CROSSROAD downloader, SHINYROAD backdoor, Adaptix C2
  • Used: Radmin scheduled tasks, side-loaded DLLs, WebDAV NTLMv2
  • Affected: Backupper (100M+ users), possibly AnyViewer in 11 countries
  • No CVE; configs unauthenticated and restored post-window
  • AOMEI released detection tool after corrective action on July 29
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. May 28, 2026First confirmed tampering window · Google Threat Intelligence
  2. Jul 16, 2026Second confirmed tampering window · Google Threat Intelligence
  3. Jul 20, 2026Third confirmed tampering window · Google Threat Intelligence
  4. Jul 29, 2026AOMEI takes corrective action · AOMEI
  5. Oct 19, 2026Reports on AOMEI Backupper compromise · Malwarebytes Labs
  6. Oct 20, 2026Multiple outlets publish analysis · SecurityWeek

What each outlet adds

beyond the shared facts
  • The RecordAOMEI has not identified or notified infected customers
  • Help Net SecurityTargets Backupper v8.3.0+ and AnyViewer; dropper skips China/unknown locations
  • Malwarebytes LabsDownloader named Malware.AI.4006642887; deletes after staging
  • SecurityWeek186 million users; more windows likely undetected
  • BleepingComputerVictims in 6 countries; July 20 NTLM theft via WebDAV
Vendors
AOMEIAOMEI Technology
Products
AOMEI BackupperAOMEI AnyViewerRadminRadmin ServerAnyViewer
Threat actors
UNC7017
Malware
CROSSROADSHINYROADCrossRoadShinyRoadAdaptAgentAdaptix C2ADAPTAGENTupgrade-now.exe
Organizations
ManageEngineGoogle Threat Intelligence GroupMandiantManageEngine Threat Analysis Lab
Countries
AustraliaBrazilIndiaPakistanPortugalSingaporeSouth AfricaSpainSwitzerlandTürkiyeUnited States

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Malwarebytes LabsFirst report

    AOMEI Backupper update servers hijacked to deliver a backdoor

    Google’s threat intel group confirmed three tampering windows of ten, six, and five minutes between April and July.

  2. · 6d ago BleepingComputer

    AOMEI update servers briefly served CROSSROAD and SHINYROAD malware

    UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.

  3. · 5d ago GBHackers

    UNC7017 hijacked AOMEI updates to install CROSSROAD and SHINYROAD

    Five- to ten-minute tampering windows in May and July 2026 exposed organizations in eleven countries without a CVE.

  4. · 5d ago Cyber Security News

    UNC7017 hijacks AOMEI updates for minutes to plant backdoors

    Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.

  5. · 5d ago SecurityWeek

    AOMEI Backupper updates briefly served malware in 2026

    UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.

  6. · 5d ago The Record

    AOMEI has not notified customers after update-server malware hijack

    Attackers briefly swapped update configs from April to July so Backupper fetched malware, and already infected PCs stay infected.

  7. · 5d ago Help Net Security

    AOMEI Backupper update servers briefly hijacked to push a backdoor

    Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.