Hackers Compromised AOMEI Software Updates in 2026
The campaign targeted update servers to push malware, exploiting a brief window of opportunity to evade detection.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust that automatic software updates on your devices are sufficiently secure?
Between April and July 2026, the threat group UNC7017 compromised AOMEI update infrastructure to deliver malware through legitimate software distribution channels. The attack involved temporary, rapid tampering with server configuration files for AOMEI Backupper and AnyViewer to push malicious payloads.
Why it matters
This incident highlights a sophisticated supply chain attack technique where attackers use extremely short tampering windows to evade traditional security monitoring. By abusing trusted update mechanisms, the campaign successfully reached victims across sectors including IT services, telecommunications, and higher education.
The attackers targeted AOMEI origin servers to modify configuration files for 5 to 10 minutes at a time, facilitating the distribution of the CROSSROAD downloader and SHINYROAD backdoor. This transient alteration allowed the malware to trigger execution via AOMEI notification mechanisms while remaining below the threshold of routine automated security scanning.
The players
UNC7017
A threat actor cluster known for conducting supply chain attacks via compromised software update infrastructure.
AOMEI
A software provider specializing in data backup, partition management, and remote desktop tools including AOMEI Backupper and AnyViewer.
The details
The attackers accessed AOMEI's update infrastructure to replace legitimate configuration files with compromised versions that directed users to malicious payloads. Once the software initiated an update, it executed the CROSSROAD downloader, which subsequently deployed the SHINYROAD backdoor. Additionally, the attackers used a 1x1 pixel invisible window—a tiny, hidden graphical interface element—to prompt the system to leak NetNTLMv2 hashes, which are encrypted identifiers used for network authentication, to attackers for credential theft.
Timeline
April 2026: The UNC7017 campaign began its activity.
Late May 2026: The operation was first detected in customer environments.
July 2026: The campaign activity concluded.
The Tech Race
This attack mirrors the 2020 SolarWinds Orion supply chain compromise by subverting the integrity of trusted update channels. It demonstrates an evolving trend where threat actors utilize ephemeral infrastructure modifications to bypass detection systems that rely on continuous monitoring.
AOMEI users should ensure their software is updated to the latest version to mitigate residual risks from the compromised infrastructure. IT administrators should audit logs for evidence of unauthorized outbound traffic or credential harvesting attempts associated with the SHINYROAD backdoor.
The takeaway
The UNC7017 campaign underscores the vulnerability of automated software distribution systems to transient infrastructure tampering. Security teams should monitor for anomalous, short-lived configuration changes and implement rigorous integrity checks for all software update manifests.
Further reading
For broader trends in enterprise defense against supply chain threats, visit the Cybersecurity section.
Source note: This article includes information reported by SecurityBrief Asia.
Live Poll
Do you trust that automatic software updates on your devices are sufficiently secure?
