Between April and July 2026, attackers briefly modified two configuration files on AOMEI’s servers to make Backupper clients download the CROSSROAD and SHINYROAD malware, in windows of five to ten minutes. If you run AOMEI Backupper, hunt for indicators of compromise: a server-side fix does not remove a backdoor already installed.

Rapid7 Labs documents “ted”, an implant compiled directly into HAProxy 2.8.12 at two South Korean companies that intercepts web traffic and erases its own connections from the load balancer’s counters. It requires a prior compromise of the host — verify the integrity of your edge binaries and watch connection counters instead of waiting for an HAProxy patch.