Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers temporarily compromised AOMEI Backupper's update servers between May and July 2026, altering update files for brief windows of 5–10 minutes to deliver a backdoor. The malicious update fetched a downloader named CROSSROAD, which deployed a signed Radmin executable and an attacker-controlled DLL to load the SHINYROAD implant, enabling remote code execution. The attackers also used a WebDAV-based pop-up to harvest NetNTLMv2 authentication tokens without executing code. The campaign, tracked by Google Threat Intelligence Group (GTIG) as UNC7017, targeted organizations across 11 countries opportunistically, affecting systems that happened to check for updates during the tampering windows.

AI-extracted · verify before operational use