2026 AOMEI Backupper — supply chain attack; malware injected into update servers
Data compromised
Windows credentials (NetNTLMv2 tokens harvested), system access, potential full compromise via C2 backdoor. Affected: IT services, telecom, education sectors across 11 countries.
Technical writeup
Attackers modified AOMEI update servers April-July 2026, injecting CROSSROAD (downloader), SHINYROAD (backdoor), and Adaptix C2 malware. Malware harvested NetNTLMv2 tokens via WebDAV popup. Affected 162+ confirmed tenants across IT, telecom, education. AOMEI acknowledged July 29; malware persisted despite patches. Verified by Google/Mandiant.
Root cause
Compromised update servers; unsigned configuration files modified by attackers; automatic updates deployed CROSSROAD, SHINYROAD, Adaptix C2 malware.