Attackers tracked as UNC7017 repeatedly altered the update configuration files on AOMEI Technology's own servers between April and July 2026, in confirmed windows of only five to ten minutes (May 28, July 16, and July 20, with more likely unobserved). Any copy of the AOMEI Backupper backup program, and possibly the AnyViewer remote desktop tool, that polled for updates during a window downloaded and ran the CROSSROAD downloader, which installed the SHINYROAD backdoor. A July 20 variant also used a WebDAV pop-up to leak NetNTLMv2 authentication hashes. Google Threat Intelligence Group and Mandiant confirmed affected organizations in IT services, telecommunications, and higher education across 11 countries, including the United States; the ManageEngine Threat Analysis Lab first detected the activity in late May and investigated it in parallel.

AOMEI told investigators it had secured its servers on July 29, but that fix does not remove implants already installed on machines that polled during a window, and both research teams urge organizations running AOMEI software to hunt across the whole April to July period.

Sources: Google Cloud (GTIG); The Hacker News