Attackers tampered with AOMEI Backupper's update servers for a short time and used them to push a malicious update to some users. The incident is a supply-chain compromise affecting AOMEI Backupper, with the attacker abusing the product's update channel rather than a user clicking a phishing link. The article indicates the malicious update installed a backdoor, giving attackers persistent remote access, but the exact victim count and full scope were not yet clear.
2026.10.20
98% relevant
This directly updates the same AOMEI update-server supply-chain incident, adding that AOMEI says it still has not identified or notified infected customers, that server tampering happened repeatedly between April and July, and that victims spanned IT services, telecom, and higher education in multiple countries.
Ionut Arghire
2026.10.20
97% relevant
This is the same underlying event: compromise of AOMEI Backupper distribution infrastructure to serve malicious updates. This report adds detailed attribution to UNC7017, a timeline of multiple short tampering windows between April and July 2026, technical delivery details involving CrossRoad, ShinyRoad, Radmin sideloading, WebDAV-triggered NetNTLMv2 hash capture, and identified victim sectors and countries.
Lawrence Abrams
2026.10.19
99% relevant
This is a fuller write-up of the same AOMEI Backupper supply-chain attack, adding attribution to UNC7017, the malware names CROSSROAD and SHINYROAD, the use of promotional and notification configuration files, the exact exposure windows, and affected sectors and countries.
info@thehackernews.com (The Hacker News)
2026.10.16
100% relevant
This article appears to establish a distinct new supply-chain incident centered on AOMEI Backupper's compromised update servers, and it does not clearly match any existing tracked story in the list.