AOMEI Blamed Interception While Hackers Hijacked Its Updates for Months, and It Still Has Not Told Customers

For roughly four months, hackers kept flipping the update servers of AOMEI Backupper, a popular Windows backup tool, so they handed out malware for five to ten minutes at a time. Then they put the clean files back, leaving almost nothing for anyone to catch. On Tuesday, AOMEI admitted it still has not identified or notified the customers who were infected.

That gap matters. A backup tool touches every file, runs constantly and is trusted by whoever installed it. Fixing the servers stops new infections, but it does nothing for machines that already received a backdoor. "A server-side fix stops new infections; it does not remove the backdoor from machines that received it during an earlier window," ManageEngine warned.

Two companies, one strange install

ManageEngine's threat lab spotted the campaign on May 28, when its endpoint software saw AOMEI Backupper suddenly install Radmin, a legitimate remote admin tool, at two unrelated companies in different countries. The install came from Backupper's built-in promotion process. When researchers tried to reproduce it, nothing happened.

The trick, BleepingComputer reported, lived in two configuration files behind the promotion and notification systems. One tells Backupper where to download packages; the other controls notifications and can trigger content to run. The attackers pointed the software to a malicious ZIP and ran it with no user interaction. Neither file is cryptographically authenticated, and the expected checksum sits inside the same file, so the attackers simply changed it.

"Nothing in AOMEI Backupper was exploited," ManageEngine said. The promotional channel did all the work.

Short bursts, built to vanish

Google's threat intelligence team, which tracks the group as UNC7017, confirmed three windows: 10 minutes on May 28, six minutes on July 16 and five minutes on July 20. Its researchers said it was the first supply chain compromise they had seen using such short windows, which slip past point-in-time triage and automated file scanning.

The payloads were new. A downloader Google calls CROSSROAD did reconnaissance, fetched components and set persistence through a scheduled task. A backdoor called SHINYROAD used real Radmin components to load malicious code and phone home. On July 20, Google also saw an invisible pop-up forcing the notification system to reach an attacker WebDAV server and leak Windows NTLM password hashes, a technique that could work even where the malware was blocked.

Google notified the victims it found, in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkey and the United States. It believes the true reach is wider, since more tampering probably happened outside its view.

Interception, then silence

ManageEngine first alerted AOMEI on June 7. The vendor suggested the content may have been intercepted and modified in transit. "The evidence did not support AOMEI's explanation," ManageEngine said. After capturing the tampering live on July 16, it sent hashes, diffs and altered files; AOMEI's initial review "had not found evidence of a breach." Mandiant notified AOMEI on July 17, and the company replied July 29 saying it had acted. The attackers struck at least twice after the first warning.

AOMEI, registered in Hong Kong, now says it "rectified some potential vulnerabilities" but was "unable to pinpoint the root cause," and only found traces of intrusion once given exact times. It says its CTO is leading an investigation and that it will assess affected users. It says only Backupper showed anomalies and AnyViewer, its remote desktop product, did not, even though Google documents targeting of AnyViewer.

The malware shut itself off on computers that appeared to be in China, or whose location it could not determine. That proves nothing about origin. "This campaign was built to leave no trace, and that includes its identity," the researchers said. The exclusion could be meant to avoid local police, dodge certain security firms or mislead investigators.

Backup software keeps turning up as a target, as in the ConnectWise cloud backup attack that reached Microsoft 365 tenants. AOMEI has released a free detection tool, and both Google and ManageEngine urge defenders to hunt across the whole April to July period, not just the three confirmed windows.

Some offers on this page may be paid placements or contain affiliate links.