Hackers hijacked AOMEI update servers to spread malware

Between April and July 2026, the UNC7017 threat actor briefly tampered with configuration files on AOMEI's servers to push the CROSSROAD downloader and SHINYROAD backdoor through AOMEI Backupper's built-in promo and notification system. Organizations in the US, Australia, India, Singapore, Spain and Switzerland were affected, with exposure windows lasting 5–10 minutes.

• Attackers modified down_html.ini and Notifycfg.ini for 5–10 minute windows
• Payloads included the CROSSROAD downloader and SHINYROAD backdoor using Radmin components
• Affected organizations span the US, Australia, India, Singapore, Spain and Switzerland
• A July 20 attempt also tried to steal NTLM hashes via a WebDAV popup