MEDIUMSupply Chain
Global

Hackers Turn Aomei Update Servers Into Malware Channels

·Source: Bank Info Security

Updated:

Executive Summary

Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliv

Analysis

Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines.

Indicators of Compromise (2)

URL (1)
https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/hackers-turn-aomei-update-servers-into-malware-channels-image_small-5-a-33147.jpg
VirusTotalURLhaus
Domain (1)
ismg-cdn.nyc3.cdn.digitaloceanspaces.com
VirusTotalURLhaus
Source Attribution

Originally published by Bank Info Security on Oct 19, 2026.

Related Threats

MEDIUMSupply Chain

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up scanning and

The Hacker News
MEDIUMSupply Chain

Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group

Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said. The post Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group appeared first on CyberScoop .

CyberScoop
MEDIUMSupply Chain

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the

The Hacker News