AOMEI still hasn't notified victims of supply-chain malware attack through backup tool

AOMEI, which develops a Windows backup application, acknowledged on Tuesday that it has not yet pinpointed or reached out to customers whose machines were compromised following a prolonged supply-chain compromise of its update infrastructure.

Through correspondence with Recorded Future News, the company—registered in Hong Kong—disclosed that attackers repeatedly modified configuration files residing on its update servers throughout April and July, causing the software to direct users toward malware downloads during brief windows of time.

The disclosure came after cybersecurity firm ManageEngine and Google Threat Intelligence Group both published findings the previous week regarding the incident, with ManageEngine's team having initially uncovered the suspicious behavior.

Researchers at Google characterized this as unprecedented in their experience, noting it represented "the first time they had encountered a supply-chain compromise with such short-burst tampering windows, 'effectively evading traditional point-in-time triage and automated file scanning.'" According to their analysis, the approach allowed attackers to remain hidden from conventional detection methods.

ManageEngine had alerted AOMEI in June after its monitoring detected irregular activity affecting two client organizations. Initially, AOMEI attributed the problem to threat actors interfering with updates during transmission rather than acknowledging any vulnerability in its own systems.

The attackers launched at least two additional waves of compromise even after this initial warning, when AOMEI stated it had examined the situation and "rectified some potential vulnerabilities," yet remained "unable to pinpoint the root cause" of the breach during its investigation.

Only following ManageEngine's July report—which furnished "the specific time at which the tampering occurred"—did AOMEI's team manage to locate "traces of the intrusion" through examination of server records and file comparison. The company subsequently patched its infrastructure and reported finding no malicious files afterward.

AOMEI did not respond to ManageEngine's description of its initial reaction. The company stated that both Google and ManageEngine had subsequently informed it the matter was resolved, though ManageEngine's own report noted it had not confirmed whether attackers had actually been locked out of AOMEI's systems.

Google disclosed that it had contacted the victims it had identified, which included organizations in IT services, telecommunications and academic institutions across nearly a dozen nations including the United States, Australia, India and Brazil.

Google's team cautioned, however, that since malware reached anyone who initiated an update check during the attack intervals, the genuine victim count likely exceeds what they documented: "Given the short duration of these windows, it is probable that additional tampering occurred throughout the campaign that remained outside our visibility."

The threat group has been designated as UNC7017 by tracking organizations.

ManageEngine stated that "Nothing in AOMEI Backupper was exploited." Rather than targeting the application itself, the attackers leveraged the mechanism through which AOMEI distributes marketing notifications, which lacked verification of the configuration information. Following each intrusion window, the attackers reverted the files to their original state, eliminating evidence for subsequent analysis.

"A backup tool runs constantly, reaches every file on the machine, is trusted by the people who installed it, and talks to its vendor on a schedule, so nothing it does looks out of place," ManageEngine's researchers explained to Recorded Future News. "For an operator who wants to go unnoticed, a backup vendor's update channel is close to perfect cover."

During one tampering window on July 20, Google documented that the attackers deployed an undetectable pop-up that forced machines to transmit Windows credential hashes to servers under their management, a method capable of succeeding even if the malware itself was prevented from executing.

Both Google and ManageEngine emphasized that fixing AOMEI's servers would not remediate machines already infected, and urged organizations running AOMEI products to search for compromise indicators spanning the entire April–July window.

ManageEngine noted that Google's investigation also documented attempts against AnyViewer, AOMEI's remote-access tool, though AOMEI maintained that its own monitoring showed "only AOMEI Backupper exhibited anomalies," with "no abnormal activity" detected in AnyViewer.

The origins and objectives of UNC7017 remain undetermined. ManageEngine reported that the malware deployed by this group contained logic to deactivate if a machine's location appeared to be within China, if geolocation failed or if particular security applications were detected.

"This campaign was built to leave no trace, and that includes its identity," the researchers stated. They noted that the China-based deactivation mechanism did not necessarily reveal the attackers' location, and might instead serve to sidestep regional law enforcement, evade specific security vendors or misdirect investigators.

AOMEI indicated the organization "will assess potentially affected users, proactively connect them, and work with them to implement the necessary security measures."

The company has made available a complimentary scanning utility and is encouraging all users who ran Backupper during the vulnerable timeframe to upgrade their installations and perform system scans.