In a sophisticated and highly targeted series of incidents, the widely used Windows backup and disk cloning software AOMEI Backupper became the vehicle for a malicious supply chain campaign between April and July of this year. Security researchers from Google Cloud\u2019s Google Threat Intelligence Group (GTIG) and Mandiant, working in tandem with the ManageEngine Threat Analysis Lab (METAL), have uncovered a campaign characterized by "ephemeral" tampering\u2014a methodology that allowed attackers to inject malware into the update stream for only minutes at a time, drastically reducing the window for detection.<\/p>\n
AOMEI Backupper is a staple in the IT world, providing essential backup, synchronization, and disk-cloning capabilities to home users, small businesses, and large-scale Windows Server environments. With a footprint spanning an estimated 186 million users globally, the software represents a high-value target for any threat actor capable of compromising its distribution infrastructure. By manipulating the very mechanism meant to keep systems secure and up-to-date, attackers successfully leveraged the trust users place in the software vendor to deliver malicious payloads directly to unsuspecting endpoints.<\/p>\n
Unlike traditional supply chain attacks\u2014such as the infamous SolarWinds incident, which involved the long-term insertion of malicious code into a software build pipeline\u2014this campaign relied on tactical, short-lived tampering windows. Researchers observed that each instance of manipulation lasted only five to ten minutes before the servers were reverted to their authentic, clean states. This "in-and-out" approach is a significant departure from standard methodologies, designed specifically to evade the scrutiny of security operations centers (SOCs) and automated integrity-monitoring tools.<\/p>\n
The threat actor behind this campaign, tracked by researchers as UNC7017, targeted the update server’s configuration files. By modifying these files, the attackers were able to redirect the AOMEI client to download a malicious ZIP archive instead of a legitimate update. Furthermore, the attackers modified the software\u2019s automatic notification service, which forced compromised systems to automatically execute the malicious content upon delivery.<\/p>\n
The campaign appears to have been opportunistic rather than narrowly targeted at specific high-value assets. Any system that happened to check for updates during those brief, five-to-ten-minute windows was at risk of infection. Despite the seemingly broad, opportunistic nature of the delivery, the downstream effects were significant. Google Cloud\u2019s investigation identified compromised entities across a diverse range of sectors, including higher education, IT services, and telecommunications. The geographical spread of these infections is equally broad, with affected organizations identified in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, T\u00fcrkiye, and the United States.<\/p>\n
Technical analysis conducted by METAL and Google Cloud reveals a fundamental weakness in how AOMEI Backupper handles updates. The software utilizes a promotional content channel\u2014a background service that polls AOMEI servers for content\u2014which includes two distinct configuration paths for delivering and executing files.<\/p>\n
Crucially, researchers found that neither of these configuration files is protected by cryptographic authentication. Furthermore, the checksum used to validate the integrity of the downloaded archive is declared within the same unauthenticated configuration file that identifies the archive itself. This architecture allowed UNC7017 to provide a malicious archive and then provide a "matching" checksum that the software would accept as valid, effectively bypassing security checks.<\/p>\n
The campaign involved a complex, multi-stage payload delivery system. Once the initial dropper, known as CrossRoad, was executed on the victim’s machine, it performed system validation and cleanup before staging the next phase of the attack. CrossRoad was responsible for establishing persistent access for the threat actors and subsequently deleting its own footprint from the disk to minimize the likelihood of discovery.<\/p>\n
The secondary payloads included a modified version of the Radmin Server, a legitimate remote administration tool. By bundling this tool with a malicious DLL, the attackers were able to establish a reverse TCP connection to their command-and-control (C&C) infrastructure, providing them with remote access to the victim’s environment. In later stages, specifically in July, researchers observed the deployment of the ShinyRoad modular backdoor framework, which provided the attackers with deeper control over the compromised systems. To facilitate further post-exploitation activities, the group also deployed AdaptAgent, a component of the Adaptix C2 framework.<\/p>\n
In an additional display of technical ingenuity, UNC7017 utilized a secondary exploitation vector to harvest credentials. By replacing a legitimate banner within the application with a 1×1 pixel window, the attackers forced the AOMEI client to request a remote resource via WebDAV. This request inadvertently transmitted NetNTLMv2 authentication hashes\u2014valuable data for lateral movement\u2014directly to the attackers’ servers.<\/p>\n
The persistence of this campaign throughout the spring and early summer underscores a dangerous evolution in supply chain threat vectors. By moving away from complex build-system compromises toward ephemeral, configuration-based tampering, attackers have developed a low-overhead, high-stealth method of distribution that is exceptionally difficult for security teams to detect in real-time.<\/p>\n
The path to remediation was not without friction. ManageEngine\u2019s analysts first identified potential irregularities on May 28 and continued to monitor the situation as the payloads changed. They observed the malicious activity in real-time again on July 16, and Mandiant independently identified the short-burst tampering on July 20.<\/p>\n
When ManageEngine initially reached out to AOMEI Technology in early June with findings regarding the potential tampering, the vendor reportedly dismissed the concerns, suggesting that the content modification was likely an interception issue occurring in transit rather than a compromise of their infrastructure. It was not until Google Cloud provided further notification in mid-July that the vendor took significant action. AOMEI Technology confirmed in late July that they had implemented corrective measures to secure their update infrastructure.<\/p>\n
This incident serves as a stark reminder of the risks associated with unauthenticated update mechanisms. For software vendors, the necessity of implementing robust cryptographic signatures for all update packages and configuration files has never been more critical. For organizations relying on third-party software, the incident highlights the importance of monitoring network traffic for unusual connections originating from background update services, even when that software is considered trusted.<\/p>\n
As UNC7017 continues to evolve its tactics, the cybersecurity community remains vigilant. The ability of these attackers to operate under the radar for months, despite the high profile of the software they exploited, marks a significant challenge for modern enterprise security. The shift toward ephemeral attacks demands a move toward more granular, behavior-based monitoring that can detect the effect<\/em> of a compromise, rather than relying solely on the identification of known malicious files. As of now, the collaborative efforts of Google, Mandiant, and ManageEngine have effectively shuttered this specific avenue of attack, but the methodology serves as a warning of the new, more clandestine reality of supply chain security.<\/p>\n","protected":false},"excerpt":{"rendered":" In a sophisticated and highly targeted series of incidents, the widely used Windows backup and disk cloning software AOMEI Backupper became the vehicle for a malicious supply chain campaign between April and July of this year. Security researchers from Google Cloud\u2019s Google Threat Intelligence Group (GTIG) and Mandiant, working in tandem with the ManageEngine Threat<\/p>\n","protected":false},"author":4,"featured_media":2217,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[373],"tags":[1865,423,1866,374,1867,445,368,1868,237,144,5,978,530,670,202],"class_list":["post-2218","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bug-bounty-vulnerabilities","tag-aomei","tag-attacks","tag-backupper","tag-bug-bounty","tag-burst","tag-campaign","tag-chain","tag-ephemeral","tag-exploited","tag-hacking","tag-security","tag-short","tag-sophisticated","tag-supply","tag-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2218"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2218\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2217"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}