[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVYdDjbgQQj_O0w3egbuWpqUm5Obu_uuvIh49E0Y5tJU":3},{"article":4,"iocs":55,"watch_terms":69,"solutions":70,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b5400baa-29d6-4fa6-abc4-6fd51c48718f","Hackers hijack AOMEI update servers to secretly spread malware","hackers-hijack-aomei-update-servers-to-secretly-spread-malware-fd5ecf","Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a [...]","Threat actor UNC7017 compromised AOMEI's update servers between April and July 2026, distributing new malware like CROSSROAD and SHINYROAD. The attackers briefly modified configuration files to redirect users to malicious ZIP archives, which were then executed without user interaction. The campaign was opportunistic and targeted organizations across multiple countries and sectors.","Hackers compromised AOMEI servers to distribute malware via software updates.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-hijack-aomei-update-servers-to-secretly-spread-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F19\u002Fbackupper-supply-chain-attack.jpg","2026-10-19T19:40:58+00:00","2026-10-19T20:00:12.206356+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"AOMEI Backupper","product",{"name":21,"type":22},"AOMEI","vendor",{"name":24,"type":25},"UNC7017","threat_actor",{"name":27,"type":19},"Radmin",{"name":29,"type":22},"ManageEngine",{"name":31,"type":22},"Google","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66],{"type":57,"value":58,"context":59},"url","https:\u002F\u002Fwww2.aomeisoftware.com\u002Fdownload\u002Fabpopup\u002Fdown_html.ini","Configuration file modified by attackers to redirect update packages.",{"type":57,"value":61,"context":62},"https:\u002F\u002Faccount.aomeitech.com\u002FNotifycfg.ini","Configuration file modified by attackers to control notifications and trigger execution.",{"type":49,"value":64,"context":65},"CROSSROAD","Previously unknown malware downloader distributed by attackers.",{"type":49,"value":67,"context":68},"SHINYROAD","Backdoor malware distributed by attackers.",[31,21,29],{"controls":71,"vendors":152},[72,101,126],{"slug":73,"name":74,"problem":75,"products":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":54,"name":102,"problem":103,"products":104},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[105,110,118],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":106,"product_name":107,"url":108,"description":109},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":127,"name":128,"problem":129,"products":130},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":148,"product_name":149,"url":150,"description":151},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[153,158],{"slug":154,"name":31,"logo_path":155,"roles":156},"google","\u002Fvendor-logos\u002Fgoogle.png",[157],"reported_by",{"slug":159,"name":29,"logo_path":160,"roles":161},"manageengine","\u002Fvendor-logos\u002Fmanageengine.png",[157],{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":174},"aomei-update-server-hijack-delivers-hidden-malware-via-config-tampering","AOMEI Update Server Hijack Delivers Hidden Malware via Config Tampering","Threat actor UNC7017 compromised AOMEI's software update infrastructure, silently redirecting legitimate update requests to malicious ZIP archives without any user interaction required. This is a classic supply chain attack: users inherently trust software update mechanisms, making them a high-value and low-resistance attack vector. The brief, targeted modification of configuration files meant the attack could fly under the radar of both the vendor and end users. This incident demonstrates that even trusted, widely-used software tools can become weapons if their distribution pipeline is not hardened and continuously monitored.",[167,168,169,170,171,172,173],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":175,"MITRE ATT&CK T1566: Phishing":176,"NIST SP 800-53 SI-2: Flaw Remediation":177,"CIS Control 17: Incident Response Management":178,"CIS Control 7: Continuous Vulnerability Management":179,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":180,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":181},"NIS2 mandates incident handling and supply chain security measures for essential entities; AOMEI and its enterprise customers would be required to have controls preventing and detecting exactly this type of update-channel compromise.","While the primary vector here is supply chain compromise, the malware delivery via trusted update processes mirrors adversary-in-the-middle techniques tracked under supply chain compromise (T1195) — mapping this highlights the need to treat update channels as a critical trust boundary.","SI-2 requires organizations to monitor for supply chain integrity issues and ensure software updates originate from trusted, verified sources — controls that would have detected the server compromise.","A tested incident response plan with defined playbooks for supply chain compromise would have enabled faster detection, containment, and communication to affected organizations during the April–July 2026 campaign window.","Continuous assessment of software supply chain components and update mechanisms would have identified the misconfigured or compromised update server before malware was distributed at scale.","This control requires organizations to manage vulnerabilities in their own systems and supplier systems, which would encompass securing and monitoring the update server pipeline against unauthorized configuration changes.","Stronger authentication and access controls on the update server infrastructure would have made it significantly harder for UNC7017 to gain the access needed to modify configuration files."]