AOMEI has not notified customers after update-server malware hijack
Original title: AOMEI yet to notify customers after hackers hijacked its software updates
Attackers briefly swapped update configs from April to July so Backupper fetched malware, and already infected PCs stay infected.
AOMEI told Recorded Future News it has not identified or notified customers infected after hackers repeatedly altered configuration files on its update servers between April and July. ManageEngine and Google Threat Intelligence Group said the changes, tracked as UNC7017, redirected AOMEI Backupper to malware for minutes, then restored the originals. Nothing in Backupper itself was exploited; the unauthenticated promotional pop-up channel was abused. AOMEI says it updated the server and released a free detection tool, while researchers say prior infections are not cleaned.
Unconfirmed: UNC7017’s origin and motive are unknown, AnyViewer targeting is disputed, and the full victim count is unconfirmed.
- Google identified victims in IT, telecom and higher education in nearly a dozen countries.
- On July 20 an invisible pop-up was used to solicit Windows password hashes.
- Malware was built to stop in China, if location was unknown, or if certain security tools were present.
- AOMEI says only Backupper showed anomalies; ManageEngine says Google also documented AnyViewer targeting.
- ManageEngine has not independently verified that the attackers lost access.
Impact: Malware via hijacked updates; possible Windows password-hash theft
| Product | Affected |
|---|---|
| AOMEI Backupper | — |
- 1.Hunt for compromise across the April–July exposure windows on systems that used AOMEI software.
- 2.Update Backupper and run AOMEI’s free detection tool.
- 3.Treat server-side fixes as insufficient to clean already infected computers.
- Vendors
- AOMEI
- Products
- AOMEI BackupperAnyViewer
- Threat actors
- UNC7017
- Organizations
- ManageEngineGoogle Threat Intelligence Group
- Countries
- United StatesAustraliaIndiaBrazil
From the original article
4 min read at therecord.mediaIn an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at a time.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.