Between April and July 2026, hackers compromised AOMEI’s servers to distribute malware through its Backupper backup software. The attackers briefly modified configuration files controlling the software’s update and notification systems, then restored them to hide their tracks. Security researchers from ManageEngine, Google, and Mandiant discovered the campaign and attributed it to a threat actor called UNC7017, who used the compromised infrastructure to spread two malware programs: CROSSROAD, a downloader, and SHINYROAD, a backdoor. Organizations in multiple countries across IT services, telecommunications, and higher education sectors were affected.
The attackers exploited three brief windows when malicious files were distributed, lasting between 5 and 10 minutes each. The CROSSROAD downloader performed reconnaissance and established persistence, while SHINYROAD used legitimate Radmin components to connect to attacker-controlled servers. Researchers also identified attempts to steal Windows authentication hashes. AOMEI stated that its chief technology officer was leading an investigation after the company secured its servers and patched vulnerabilities, though the company did not confirm how attackers gained initial access or whether the compromise was fully resolved.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
