Attackers repeatedly modified configuration files on AOMEI’s update servers, briefly redirecting users of the Windows backup application AOMEI Backupper to malware. The supply-chain attack operated in short windows between April and July, although the Recorded Future News report does not specify the year.
AOMEI, a Hong Kong-registered software company, confirmed the server-side tampering by email to the publication. The threat cluster is tracked by Google as UNC7017, but its origin and motivation have not been established.
Users who ran Backupper during the exposure windows may require endpoint-level investigation. Updating AOMEI’s servers prevents the same delivery route from operating but does not remove malware or other traces from machines already reached through it.
Attackers abused an unauthenticated pop-up channel
According to ManageEngine’s findings as summarized by Recorded Future News, the attackers did not exploit a vulnerability in AOMEI Backupper itself. Instead, they manipulated the channel used by the application to deliver promotional pop-ups.
That mechanism did not authenticate its configuration files. During tampering periods lasting only minutes, altered files instructed the software to download malicious content. The attackers then restored the legitimate configurations, reducing the likelihood that later server inspections or automated file scans would detect the changes.
Google reported that anyone checking for updates during one of those windows received the malicious delivery. That does not establish that every exposed device was successfully infected, but it means the affected population may extend beyond the victims already identified.
ManageEngine first alerted AOMEI in June after its security software detected suspicious activity at two customers. ManageEngine said AOMEI initially attributed the problem to attackers intercepting and modifying updates in transit. After that warning, the update infrastructure was reportedly manipulated on at least two more occasions.
AOMEI investigated, corrected what it described as potential vulnerabilities, but did not identify the root cause at that stage. In July, timing information supplied by ManageEngine allowed the company to compare server files and logs, where it said it found traces of the intrusion. AOMEI then updated the server and reported finding no malicious files afterward.
Invisible pop-up exposed Windows password hashes
Google described a separate effect during the July 20 tampering window: an invisible pop-up caused affected Windows systems to send password hashes to an attacker-controlled server.
This technique could expose credentials even if security controls prevented the accompanying malware from executing. Possession of password hashes can create further risk for organisations if the same credentials remain usable elsewhere in their environments.
ManageEngine also reported that the delivered malware stopped running when a system appeared to be in China, when its location could not be determined, or when certain security products were present. The company cautioned that the geographic exclusion does not identify the operators’ location and could have been intended to misdirect investigators.
Victims span several industries and countries
Google identified affected organisations in IT services, telecommunications and higher education across almost a dozen countries, including the United States, Australia, India and Brazil. It notified the victims it had identified.
No precise count of affected organisations or devices was provided. Google’s assessment that delivery occurred whenever a user checked for updates during a tampering window suggests that the known cases may represent only part of the exposure.
At the time of the report, AOMEI said it had not yet identified or notified affected customers. The company said it planned to assess potentially affected users and contact them proactively.
AOMEI and researchers differ on the incident’s scope
AOMEI stated that only AOMEI Backupper showed anomalies and that its monitoring found no abnormal activity involving AnyViewer, the company’s remote-desktop product. ManageEngine, however, said Google’s findings documented targeting of AnyViewer. The available reporting does not resolve that conflict.
There is also disagreement over whether the attackers have definitively lost access. AOMEI said Google and ManageEngine had told it the issue was resolved. ManageEngine said it had not independently established that UNC7017 could no longer access AOMEI’s infrastructure.
Backupper users should investigate the full exposure period
AOMEI has released a free detection tool and advised people who ran Backupper during the exposure windows to update the application and scan their systems. Organisations should examine relevant endpoints and credentials across the entire April-to-July period rather than limiting checks to the day the server was updated.
Because the July 20 activity could transmit Windows password hashes without relying on successful malware execution, a clean malware scan alone may not address every consequence. Security teams should include possible credential exposure in their response and take appropriate steps for accounts associated with systems that contacted AOMEI’s infrastructure during the documented windows.
