Security · Updated 20 Oct, 01:10 am IST
Hackers used AOMEI update servers to distribute malware via Backupper
Why it matters for readers: This shows how attackers can use trusted update channels to infect systems and why timely security monitoring matters.
- Attackers hijacked AOMEI Backupper's update and notification systems to distribute malicious files.1
- The incident occurred between April and July 2026 and was first detected on May 28.1
- Researchers from ManageEngine METAL, Google's Threat Intelligence Group, and Mandiant investigated the campaign.1
- The activity is attributed to a threat actor tracked as UNC7017, which deployed CROSSROAD (a downloader) and SHINYROAD (a backdoor).1
- Affected organisations were identified in several countries — including the United States, Australia, India, Singapore, Spain and Switzerland — across sectors like IT services, telecommunications and higher education.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started