Incident BriefingsAOMEI update infrastructure compromise

AOMEI update infrastructure compromise

Short-lived changes to update instructions redirected AOMEI clients to malicious payloads.

Last modified

Summary

  • Environment: AOMEI distribution servers and Windows Backupper clients
  • Operational impact: Update channel delivered remote-access payloads
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 19, 2026; updated as evidence emerges.

What happened

AOMEI Technology’s update infrastructure was briefly altered to deliver malicious software, according to Google’s investigation. Captured tampering windows on May 28, July 16 and July 20, 2026 lasted ten, six and five minutes. [2]

ManageEngine Threat Analysis Lab’s report describes Backupper installing a remote-administration payload on two unrelated customer endpoints on May 28. [1]

Impact

Google reported affected organizations across eleven countries, without a complete victim count. Its investigation identified the CROSSROAD downloader and SHINYROAD backdoor. [2]

The reviewed evidence does not establish a total affected population or confirmed personal-data theft.

Timeline

  1. Endpoint activity detected

    METAL observed the execution chain in customer telemetry.

    [1]

  2. Vendor notified

    METAL notified AOMEI.

    [1]

  3. Transient tampering captured

    A six-minute window changed update configurations; another occurred July 20.

    [2]

  4. Vendor reported corrective action

    Mandiant reports AOMEI’s response following its July 17 notification.

    [2]

  5. Google investigation published

    The technical report documented the campaign.

    [2]

  6. Briefing updated

    This briefing was last reviewed and updated on October 19, 2026.

Threat Group & Attack Vector

METAL found that clients trusted unauthenticated configuration files, including a checksum stored alongside the download instruction. The payload used a scheduled task for persistence. [1]

The original method of access to AOMEI’s servers remains unestablished here.

Actors

  • Google tracks the activity as UNC7017; this does not identify a country or individual operator. [2]

TTPs

Response

AOMEI reported infrastructure repairs to the investigators. METAL had not independently verified containment at its October 16 publication. [1]

Google warned that repairing distribution servers would not remove malware already installed on endpoints. [2]