AOMEI says it has not yet identified or notified the customers infected after attackers tampered with its update servers between April and July 2026. ManageEngine's Threat Analysis Lab and Google's Threat Intelligence Group, working with Mandiant, attribute the campaign to UNC7017, which abused the channel AOMEI Backupper uses to deliver promotional pop-ups: two configuration files at aomeisoftware.com and aomeitech.com were briefly rewritten to point the software at malware, then restored so later inspection found nothing — Google called the short-burst tampering the first supply-chain compromise it had seen that evades point-in-time triage. The payloads were a previously unknown downloader, CROSSROAD, and a backdoor, SHINYROAD; during a 20 July window an invisible pop-up also coerced machines into sending Windows password hashes to an attacker server. ManageEngine first warned AOMEI on 28 May after Backupper silently installed Radmin at two customers; AOMEI blamed interception in transit and could not find the root cause. Google notified victims in IT services, telecommunications and higher education across nearly a dozen countries including the United States, Australia, India and Brazil, and says the true number is probably higher. AOMEI's server-side fixes do not clean machines already infected.

• Source article