A sophisticated and stealthy campaign has targeted millions of users of popular Windows utility software AOMEI Backupper, utilizing a series of short-burst supply chain compromises to distribute malicious payloads. According to security researchers from Google Cloud\u2019s Threat Intelligence Group (GTIG), Mandiant, and the ManageEngine Threat Analysis Lab (METAL), the attacks took place between April and July, exploiting update mechanisms to slip dangerous malware past unsuspecting users.<\/p>\n
AOMEI Backupper is widely used across the globe for data backup, system synchronization, and disk cloning. Available in both free and paid editions tailored for home consumers, corporate environments, and Windows Server infrastructures, the software\u2019s developer, AOMEI, claims its products are utilized by more than 186 million individuals and organizations worldwide. Because of this massive user base, any compromise of its distribution or update channels carries severe global implications.<\/p>\n
Unlike traditional software supply chain attacks\u2014which typically involve long-term backdoors inserted directly into source code repositories or malicious modifications introduced deep within developer build pipelines\u2014this campaign relied on a radically different tactic. The threat actor, tracked by researchers under the identifier UNC7017, utilized short-lived tampering windows to inject malicious payloads into the software’s update cycle before swiftly reverting the servers back to authentic versions.<\/p>\n
According to a joint report by Google Cloud\u2019s GTIG and Mandiant, which investigated the activity alongside METAL, each tampering window remained active for only five to ten minutes at a time. Because these malicious updates were rolled out and pulled back so rapidly, any system that happened to fetch the modified AOMEI Backupper packages during those precise windows was automatically infected. This opportunistic approach ensured a broad cast net rather than a heavily targeted assault against specific high-value networks.<\/p>\n
Despite the fleeting nature of the attack windows, the fallout has been observed across multiple continents. Google Cloud\u2019s ongoing telemetry and investigations have identified compromised entities operating within higher education, information technology services, and telecommunications sectors. Affected organizations span a broad geographic footprint, including Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, T\u00fcrkiye, and the United States.<\/p>\n
Researchers emphasize that while multiple tampering windows were officially confirmed throughout the campaign\u2014with related malware samples appearing in the wild as early as late April\u2014the exceptionally short duration of these windows suggests that additional tampering incidents likely occurred completely outside the visibility of security telemetry. <\/p>\n
During these brief operational windows, UNC7017 targeted AOMEI’s update infrastructure by altering the update server\u2019s settings file. This modification tricked client systems into redirecting their download requests toward a malicious ZIP archive instead of the legitimate software update. Simultaneously, the attackers manipulated the server\u2019s automatic notification service, forcing target systems into silently and automatically executing the newly retrieved malware without requiring user interaction or displaying warning prompts.<\/p>\n
Detailed technical analysis conducted by METAL revealed that the hackers successfully abused AOMEI Backupper\u2019s promotional content delivery channel to distribute their payloads. This specific channel operates via background services that continuously poll AOMEI\u2019s servers for fresh content. It includes two distinct configuration paths designed to deliver downloaded content into a specific directory and subsequently execute it. <\/p>\n
The investigation showed that these two configuration paths converge on the exact same local destination. One path controls what files land in the target directory, while the other governs what can be executed from within it. Compounding the security risk, neither of the configuration files is cryptographically authenticated by the client software. Furthermore, the checksum used to validate the integrity of the downloaded archive is declared inside the very same unauthenticated file that names the archive itself, leaving the mechanism vulnerable to manipulation.<\/p>\n
Threat analysts at ManageEngine first caught a glimpse of the potential attack path on May 28, before observing the malicious changes to AOMEI\u2019s served payloads in real time on July 16. Just a few days later, on July 20, the short-burst tampering methodology was independently intercepted and documented by Mandiant.<\/p>\n
A deep forensic inspection of the payloads delivered during the campaign uncovered a multi-tiered malicious framework. In some instances, the attackers delivered a legitimate version of the Radmin Server remote administration tool, accompanied by a malicious dynamic-link library (DLL). This DLL was designed to be loaded side-by-side with Radmin, subsequently establishing an unauthorized reverse TCP connection back to command-and-control (C&C) servers operated by UNC7017.<\/p>\n
In addition to the modified Radmin binaries, Google Cloud researchers observed UNC7017 introducing a secondary exploitation vector. The threat actor replaced a legitimate user interface banner within the application with a microscopic, one-by-one pixel window assigned maximum execution priority. This hidden element forced the AOMEI client application to request a remote resource via WebDAV, inadvertently transmitting NetNTLMv2 authentication hashes belonging to the local system straight to the attackers.<\/p>\n
Throughout the lifecycle of the campaign, UNC7017 deployed a diverse arsenal of malware components. These included the CrossRoad downloader, a modified edition of the Radmin Server tool, and the Adaptix command-and-control framework. <\/p>\n
The CrossRoad downloader functioned primarily as an initial reconnaissance and staging tool. Upon execution, it performed system validation checks, cleaned up installation artifacts, established persistence mechanisms for the late-stage backdoors, and ultimately deleted itself from the local disk to minimize forensic footprints. The final stage payload distributed by this chain was the ShinyRoad modular backdoor framework. Following the successful deployment of ShinyRoad in July, UNC7017 was further observed dropping AdaptAgent, a core component designed for post-exploitation operations within the Adaptix C2 ecosystem.<\/p>\n
Security experts note that this campaign marks a significant evolution in the methodology of software supply chain attacks. While historical intrusions have largely focused on compromising upstream developer environments or tampering with source code, UNC7017\u2019s use of ephemeral configuration tampering demonstrates a lower-overhead and considerably higher-stealth alternative that bypasses traditional code-signing checks and source repository audits.<\/p>\n
The disclosure process following the discovery of the campaign involved multiple cybersecurity firms and the software vendor itself. METAL reported that it initially notified AOMEI Technology of potential tampering vulnerabilities in early June. However, the vendor reportedly dismissed the initial findings, suggesting that the content may have been intercepted and modified dynamically in transit by third parties. <\/p>\n
Following further investigation and comprehensive data compiled by Google Cloud, a secondary notification was issued to AOMEI in mid-July. By late July, the software vendor acknowledged the reports, confirming that appropriate corrective actions had been implemented to secure their update servers and close the exploitation vectors abused during the campaign.<\/p>\n","protected":false},"excerpt":{"rendered":"
A sophisticated and stealthy campaign has targeted millions of users of popular Windows utility software AOMEI Backupper, utilizing a series of short-burst supply chain compromises to distribute malicious payloads. According to security researchers from Google Cloud\u2019s Threat Intelligence Group (GTIG), Mandiant, and the ManageEngine Threat Analysis Lab (METAL), the attacks took place between April and<\/p>\n","protected":false},"author":7,"featured_media":2183,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[313],"tags":[1865,423,1870,1866,323,1867,368,1869,1868,321,320,978,670,322],"class_list":["post-2184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response-forensics","tag-aomei","tag-attacks","tag-backdoors","tag-backupper","tag-blockchain-analysis","tag-burst","tag-chain","tag-delivering","tag-ephemeral","tag-forensics","tag-incident-response","tag-short","tag-supply","tag-tracking"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2184"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2184\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2183"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}