So, surprise! Hackers decided to play a little game with AOMEI's update servers, turning the company’s backup software into a delivery mechanism for malware. Because why not? It’s not like we need to keep things safe or anything.
The Plot
Between April and July 2026, some clever clogs compromised the update and notification systems of AOMEI Backupper—an app that prides itself on backing up your precious data, only to end up spilling it instead. These digital party crashers tweaked a couple of configuration files before putting everything back to ‘normal’—because that's how hackers roll.
Thanks to the vigilant folks at ManageEngine's Threat Analysis Lab (METAL) and their buddies over at Google, we learned that these attackers, dubbed UNC7017, were using AOMEI’s infrastructure to spread a cheeky piece of malware called CROSSROAD and a backdoor known as SHINYROAD. Classy, right?
Who Was Affected?
Well, get this: Organizations in countries like the U.S., Australia, and even Switzerland were caught in the crossfire. Turns out, if you were checking for updates during the attack, you might have downloaded malware instead of those exciting new features.
The Discovery
The first red flag went up on May 28 when AOMEI Backupper started installing a remote administration tool, Radmin, on computers at unrelated businesses. Spoiler alert: this wasn’t part of the plan.
After some fun detective work, researchers found that the hackers had modified two key configuration files that control where the backup software downloads its update packages and where it gets its notifications. By playing around with these, they managed to sneak in a malicious ZIP file into the mix.
Sneaky, Sneaky
The attackers were smart—after altering the files to serve their malware, they reverted everything back within minutes, making it super hard to catch them red-handed. They even swapped checksums to pass AOMEI's file verification checks. It’s like they were adding a layer of 'you snooze, you lose' to their already questionable behavior.
What’s Next for AOMEI?
After the researchers turned up the heat, AOMEI finally started taking things seriously. They claimed their CTO was leading an investigation. Let’s hope they aren’t doing it the bureaucratic way—slow and with plenty of coffee breaks.
While AOMEI says they’ve patched the holes and tightened security, beware! Just because the front door is fixed doesn't mean the backdoor is locked. Malware that slipped through the cracks during these 'fun' windows might still be lurking on affected machines.
Bottom Line
Organizations using AOMEI Backupper are now advised to investigate any suspicious activity on their systems, check for unexpected files, and pray that their data isn’t already in the wrong hands.
Because in the wild world of cybersecurity, it seems the hackers are always one step ahead—or at least, they’re much better at hiding their messes than we are at cleaning them up. Cheers to that!
