Hackers used AOMEI’s update servers to deliver malware
The brief tampering windows mean organizations that checked for updates during that period may have been exposed without seeing obvious warning signs.
Researchers say attackers abused AOMEI Backupper’s update and notification infrastructure to push malware through brief server-side tampering, affecting users in multiple countries and exposing how a trusted software channel can be turned into a delivery path. ManageEngine and Google attribute the activity to UNC7017 and say it involved a new downloader, CROSSROAD, and a backdoor, SHINYROAD, along with at least one attempt to steal Windows authentication hashes. The malicious configuration files were observed in short windows on May 28, July 16, and July 20, and the attackers reverted the files within minutes to make the compromise harder to spot. AOMEI was told about suspicious activity on June 7, and ManageEngine says it later handed over hashes, diffs, and altered files after capturing the July 16 incident. Google said the campaign was opportunistic and may have reached other organizations that checked for updates during those brief exposure periods.
Why it matters
This turns a routine software-update path into a hidden delivery route for malware, which raises the risk for any organization relying on the affected channel. Because the malicious content was served only in short windows and then altered, detection was harder, and Google warned other organizations may also have been reached if they checked for updates at the wrong time.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer