Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Between May and July 2026, attackers identified as UNC7017 tampered with AOMEI Backupper update servers. For five to ten minute windows, unsigned update and notification files were modified to deliver a backdoor. Compromised Windows machines downloaded the CROSSROAD downloader, SHINYROAD implant via signed Radmin, and Adaptix C2. Some attacks leaked NetNTLMv2 hashes. AOMEI implemented server corrective actions on July 29, though existing implants remain. Google Threat Intelligence Group, Mandiant, and ManageEngine reported the incident.