--- title: "AOMEI update infrastructure compromise" description: "Investigators found brief AOMEI update-server changes delivering malware; vendor-reported repairs did not establish endpoint recovery." incident_type: "Malware incident" status: "active" last_modified: "2026-10-19" canonical_url: "https://www.ally.security/incidents/aomei-update-infrastructure-compromise-2026" markdown_url: "https://www.ally.security/incidents/aomei-update-infrastructure-compromise-2026.md" stix_url: "https://www.ally.security/incidents/aomei-update-infrastructure-compromise-2026/stix.json" --- # AOMEI update infrastructure compromise Short-lived changes to update instructions redirected AOMEI clients to malicious payloads. Last modified Oct 19, 2026 · 2 sources ## Summary - **Environment:** AOMEI distribution servers and Windows Backupper clients - **Operational impact:** Update channel delivered remote-access payloads - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [AOMEI Technology’s](https://www.aomeitech.com/) update infrastructure was briefly altered to deliver malicious software, according to [Google’s investigation](https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering). Captured tampering windows on May 28, July 16 and July 20, 2026 lasted ten, six and five minutes. [2](#source-2) [ManageEngine Threat Analysis Lab’s report](https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html) describes Backupper installing a remote-administration payload on two unrelated customer endpoints on May 28. [1](#source-1) ## Impact Google reported affected organizations across eleven countries, without a complete victim count. Its investigation identified the CROSSROAD downloader and SHINYROAD backdoor. [2](#source-2) The reviewed evidence does not establish a total affected population or confirmed personal-data theft. ## Timeline ### May 28, 2026 — Endpoint activity detected METAL observed the execution chain in customer telemetry. [1](#source-1) ### June 7, 2026 — Vendor notified METAL notified AOMEI. [1](#source-1) ### July 16, 2026 — Transient tampering captured A six-minute window changed update configurations; another occurred July 20. [2](#source-2) ### July 29, 2026 — Vendor reported corrective action Mandiant reports AOMEI’s response following its July 17 notification. [2](#source-2) ### October 15, 2026 — Google investigation published The [technical report](https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering) documented the campaign. [2](#source-2) ### October 19, 2026 — Briefing updated This briefing was last reviewed and updated on October 19, 2026. ## Threat Group & Attack Vector METAL found that clients trusted unauthenticated configuration files, including a checksum stored alongside the download instruction. The payload used a scheduled task for persistence. [1](#source-1) The original method of access to AOMEI’s servers remains unestablished here. ### Actors - Google tracks the activity as UNC7017; this does not identify a country or individual operator. [2](#source-2) ### TTPs - [T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/): update instructions delivered malicious content. [2](#source-2) - [T1053.005 — Scheduled Task](https://attack.mitre.org/techniques/T1053/005/): task-based persistence maintained payload execution. [1](#source-1) ## Response AOMEI reported infrastructure repairs to the investigators. METAL had not independently verified containment at its October 16 publication. [1](#source-1) Google warned that repairing distribution servers would not remove malware already installed on endpoints. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### AOMEI Backupper supply-chain compromise: Investigation and analysis research · ManageEngine Threat Analysis Lab · Oct 16, 2026 ### Investigating Ephemeral Supply Chain Tampering research · Google Threat Intelligence Group / Mandiant · Oct 15, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: METAL detected Backupper installing a remote-administration payload on two unrelated customer endpoints on May 28. 2. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Google published its investigation 3. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: METAL observed the endpoint execution chain 4. **Occurred At · 100% confidence · current** METAL notified AOMEI: 2026-06-07 5. **Occurred At · 100% confidence · current** Vendor reported corrective action to Mandiant: 2026-07-29 6. **Used Product · 100% confidence · current** AOMEI update infrastructure compromise: AOMEI Backupper 7. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: The payload established a scheduled task to maintain execution of the backdoor components. 8. **Affected Organization · 100% confidence · current** AOMEI update infrastructure compromise: AOMEI Technology 9. **Used Malware · 100% confidence · current** AOMEI update infrastructure compromise: CROSSROAD 10. **Occurred At · 100% confidence · current** METAL observed the endpoint execution chain: 2026-05-28 11. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Vendor reported corrective action to Mandiant 12. **Used Malware · 100% confidence · current** AOMEI update infrastructure compromise: SHINYROAD 13. **Occurred At · 100% confidence · current** Google published its investigation: 2026-10-15 14. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: METAL notified AOMEI 15. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Investigators captured transient tampering 16. **Used Attack Technique · 100% confidence · current** AOMEI update infrastructure compromise: https://attack.mitre.org/techniques/T1053/005/ 17. **Occurred At · 100% confidence · current** Another short tampering window observed: 2026-07-20 18. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Google reported affected organizations across eleven countries, without a complete victim count. 19. **Attributed To · 100% confidence · current** AOMEI update infrastructure compromise: UNC7017 20. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: METAL found unauthenticated update configuration files with the archive checksum inside the same configuration that specified its download. 21. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Confirmed server-tampering windows were May 28, July 16 and July 20, lasting ten, six and five minutes respectively. 22. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Mandiant notified AOMEI July 17; AOMEI reported corrective action July 29. Server-side repair does not remove earlier endpoint infections. 23. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: METAL notified AOMEI June 7 and had not independently verified containment when it published October 16. 24. **Occurred At · 100% confidence · current** Investigators captured transient tampering: 2026-07-16 25. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Investigators captured brief changes to AOMEI update configurations that redirected clients to malicious content. 26. **Used Attack Technique · 100% confidence · current** AOMEI update infrastructure compromise: https://attack.mitre.org/techniques/T1195/002/ 27. **Resulted In · 100% confidence · current** AOMEI update infrastructure compromise: Another short tampering window observed