AOMEI Backupper Update Servers Tampered With in 5–10 Minute Windows to Push a Backdoor

Researchers from Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab disclosed an unusual supply-chain attack. The attackers repeatedly changed, for five to ten minutes at a time, the files that AOMEI Backupper fetches from the vendor's own servers. Any copy of this Windows backup tool that checked for an update during one of those windows downloaded and ran a backdoor.

AOMEI Backupper is made by Hong Kong-registered AOMEI Technology. Like the company's remote-desktop tool AnyViewer, it runs background services that regularly poll AOMEI's servers over HTTPS for updates and promotional pop-ups. Two files drive the check: down_html.ini names the package and its checksum, while Notifycfg.ini tells the pop-up service what to show and what to run.

No vulnerability involved

Strikingly, nothing in the software was exploited. No bug, no user action — the program only had to be installed and running. The catch is that AOMEI does not cryptographically verify these files, and the checksum meant to prove a download is genuine sits inside the same unsigned file that names it. The attacker only had to edit two text files on the server for a few minutes.

The downloaded package ran with the privileges of the AOMEI process, which on the examined machines was enough to install software across the whole system.

Three windows, eleven countries

Three tampering episodes were confirmed: May 28 (10 minutes), July 16 (6 minutes) and July 20 (5 minutes), all UTC. A copy that checked before or after a window got clean, genuine files — which is what makes the attack hard to catch. GTIG called the targeting opportunistic: it hit whatever polled during those minutes. From its telemetry GTIG found affected organizations in IT services, telecommunications and higher education across 11 countries, including Australia, Brazil, India, the US and Türkiye; the real number is likely higher.

The group is tracked as UNC7017, with no country or known actor named. GTIG said this is the first Windows supply-chain compromise it has seen of such short duration, effectively evading point-in-time triage and automated file scanning.

What landed on the machine

A downloader called CROSSROAD unpacked a bundle into a local Radmin folder, created a scheduled task running every three hours, and deleted itself from disk. The bundle included a genuine, signed copy of Radmin, but that is not what ran: control came from a separate implant, SHINYROAD, reaching out to a single hard-coded address. CROSSROAD stopped if it found the machine was in China or carried particular security agents.

The July 20 window added a trick that ran no code: the notification file opened an invisible, one-pixel pop-up pointing via WebDAV to a file on the attacker's server, which could make Windows send the logged-in user's NetNTLMv2 authentication response to it.

A fixed server does not clean the machine

AOMEI says it fixed its servers, but that does not remove the backdoor from already-infected machines: the downloader restored the genuine update file, so an infected system can look normal. Researchers urge organizations to hunt across the whole April-to-July period and not to judge an alert by the vendor's download page, which serves genuine content almost all the time. Neither report says how the attacker gained the ability to change files on AOMEI's servers.

Source: The Hacker News