THE SCAM There's a popular Windows program called AOMEI Backupper that people use to back up their files and clone their hard drives. Between April and July 2026, hackers broke into the company's own update system. For a few minutes at a time — 10 minutes on May 28, six on July 16, five on July 20 — they quietly rewrote two small configuration files on AOMEI's servers. Those files told the program what to download, so anyone whose computer checked for updates during those windows got more than an update: it installed a malicious downloader called CROSSROAD and a backdoor called SHINYROAD, including a remote-access tool that could let the attackers reach into the computer from afar. No fake email, no trick link. The malware arrived through the company's real update channel. Researchers at ManageEngine, working with Google's threat team and Mandiant, traced it to a group they call UNC7017, and found victims in the US, Australia, India, Singapore, Spain, and Switzerland — with more possible, since Google warns the attacks were opportunistic. AOMEI says its CTO is investigating and that it has secured its servers, but it hasn't said how the attackers got in or whether the compromise is fully resolved.

THE RED FLAG The only thing that caught this was security software watching for weird behavior. ManageEngine's endpoint protection noticed AOMEI Backupper suddenly installing a remote-access tool it had no business installing — at two unrelated companies in two different countries. When researchers tried to reproduce it on their own test computers, nothing happened: the attackers were only flipping the malicious files into place for minutes, then flipping them back before anyone could look. They even rewrote the expected checksum, so the program's own file verification waved the malware through. The uncomfortable part: every normal "is this from the real company?" check passes here — the sender was real, the address was real, the signature check passed — because the attack lived inside the real company's servers.

THE RULE Keep your computer's security software turned on and up to date — in this story it's the only thing that sounded the alarm. If a trusted program starts acting strange right after an update — new pop-ups, slowness, something installing itself that you didn't ask for — don't shrug it off: run a full scan before you type in another password. And when you install software, grab it from the vendor's own site, not from random download mirrors, so you're never trusting an extra middleman.

Read it on the site: https://erawaeb.com/digest/daily/037-the-update-that-came-with-malware-inside/

One scam. One red flag. One rule. Every day. — ERAWAEB