AOMEI yet to notify customers after hackers hijacked its software updates

AOMEI, the maker of a standalone Windows backup tool, said Tuesday it has not yet identified or notified customers who were infected with malware after hackers hijacked its update server in a monthslong supply-chain attack.

In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at a time.

The confirmation follows coordinated reports published last week by cybersecurity firm ManageEngine, whose researchers first detected the activity, and Google Threat Intelligence Group which investigated it further.

Google’s researchers said it was the first time they had encountered a supply-chain compromise with such short-burst tampering windows, “effectively evading traditional point-in-time triage and automated file scanning.”

ManageEngine said it first warned AOMEI in June, after its software detected suspicious activity at two customers. According to ManageEngine, AOMEI initially blamed malicious actors intercepting and modifying its update in transit rather than any issue on its own end.

The attackers struck at least twice more after the first warning, when AOMEI said it investigated the incident and “rectified some potential vulnerabilities,” but was “unable to pinpoint the root cause” of the breach during that investigation.

AOMEI added that it was only after ManageEngine’s report in July, when the researchers provided “the specific time at which the tampering occurred,” that its team was able to identify “traces of the intrusion” by analysing server logs and comparing files. It said it then updated the server and has found no traces of malicious files since.

AOMEI did not address ManageEngine’s account of its initial explanation. The company claimed that Google and ManageEngine had since told it the issue was resolved, although ManageEngine’s report states it had not independently verified that the attackers had lost access to AOMEI’s infrastructure.

Google said it had notified the victims that it had identified, saying they spanned IT services, telecommunications and higher education in almost a dozen countries including the U.S., Australia, India and Brazil.

However the Google researchers warned that because the malware was sent to anyone who checked for updates during the attack windows, the true number of victims is probably higher: “Given the short duration of these windows, it is probable that additional tampering occurred throughout the campaign that remained outside our visibility.”

They are tracking the threat cluster as UNC7017.

“Nothing in AOMEI Backupper was exploited,” ManageEngine wrote. The attackers instead abused the channel AOMEI uses to deliver promotional pop-ups, which didn’t authenticate the configuration files. After each tampering window, the attackers restored the original files, leaving nothing for later inspections to find.

“A backup tool runs constantly, reaches every file on the machine, is trusted by the people who installed it, and talks to its vendor on a schedule, so nothing it does looks out of place,” the ManageEngine researchers told Recorded Future News. “For an operator who wants to go unnoticed, a backup vendor’s update channel is close to perfect cover.”

During the July 20 window, Google said, the attackers also used an invisible pop-up to coerce machines into sending Windows password hashes to an attacker-controlled server, a technique that could work even where the malware itself was blocked.

Both Google and ManageEngine warned that AOMEI’s server fixes would not clean computers that had already been infected, and urged organizations using AOMEI software to hunt for signs of compromise across the whole April–July period.

ManageEngine said Google’s report also documents targeting of AnyViewer, AOMEI’s remote-desktop product although AOMEI said its monitoring found that “only AOMEI Backupper exhibited anomalies,” with “no abnormal activity” in AnyViewer.

UNC7017’s origin and motivation remains unknown. According to ManageEngine, the malware used by the group was designed to stop if a computer appeared to be in China, if its location could not be determined or if certain security products were installed.

“This campaign was built to leave no trace, and that includes its identity,” the researchers said. They cautioned that the China exclusion did not establish where the attackers were based, and could be intended to avoid local law enforcement, avoid particular security firms or mislead investigators.

AOMEI said the company “will assess potentially affected users, proactively connect them, and work with them to implement the necessary security measures.”

The company has released a free detection tool and is urging anyone who used Backupper during the exposure windows to update and scan their systems.