Hackers Hijack AOMEI Infrastructure in Supply Chain Attack
Cybersecurity researchers identified a campaign where attackers used AOMEI systems to distribute hidden backdoors.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust that automatic software updates on your devices are always safe to install?
Between April 2026 and July 2026, hackers compromised the update infrastructure of AOMEI Technology to spread malicious backdoors. The campaign, identified as UNC7017, involved modifying server configurations to distribute the unauthorized software.
Why it matters
The attack highlights the vulnerabilities inherent in software supply chains, where trusted update channels are leveraged to bypass standard security defenses. By the time detection occurred, the attackers had already moved to restore legitimate content.
The UNC7017 campaign involved the modification of server configurations at AOMEI Technology over a four-month period. Attackers successfully distributed hidden backdoors through these compromised channels before reverting to legitimate content.
The players
AOMEI Technology
This is a software developer that was targeted during the UNC7017 infrastructure hijacking campaign.
ManageEngine
This is a software company whose Threat Analysis Lab identified the malicious activity through advanced endpoint telemetry.
The details
ManageEngine's Threat Analysis Lab utilized endpoint telemetry to uncover the unauthorized activity. The perpetrators maintained their access by alternating configurations during the exploitation period to avoid detection.
Timeline
April 2026: The hackers began altering AOMEI Technology server configurations.
May 2026: ManageEngine detected suspicious activity through endpoint telemetry.
July 2026: The modification of server configurations by the attackers concluded.
The Tech Race
This event follows a pattern set by the 2020 SolarWinds supply chain attack, demonstrating how threat actors weaponize trust in vendor-provided update infrastructure to distribute malware. It underscores the ongoing arms race between defenders and sophisticated groups using supply chain vectors to bypass perimeter security.
Users of AOMEI software should ensure their applications are updated to the latest verified versions to mitigate risks from past compromises. Organizations should prioritize endpoint telemetry tools to identify anomalies in software traffic that may indicate hidden backdoors.
The takeaway
Supply chain attacks serve as a reminder that even legitimate software updates can pose risks if infrastructure is compromised. Users should maintain robust security monitoring to detect unexpected behavior following any software update.
Further reading
For more information on current digital security trends, see our Cybersecurity section.
Live Poll
Do you trust that automatic software updates on your devices are always safe to install?
