AOMEI says its chief technology officer is leading a high-priority investigation into reported tampering with the infrastructure used by its AOMEI Backupper software, according to a company statement published by BleepingComputer on October 19.
The investigation follows researchers’ account of a supply-chain campaign against AOMEI’s update and notification systems between April and July. The reported malicious-serving windows were historical: ten minutes on May 28, six minutes on July 16, and five minutes on July 20. Researchers said attackers temporarily altered configuration files that directed Backupper clients to download a malicious ZIP archive and changed the expected checksum, then restored the original files within minutes.
Google and ManageEngine attributed the activity to UNC7017, BleepingComputer reported. The campaign delivered the CROSSROAD downloader and SHINYROAD backdoor. During the July 20 window, Google also observed an attempt to make the notification system access an attacker-controlled WebDAV resource, which could expose NTLM hashes.
AOMEI told BleepingComputer that it had upgraded servers, patched potential vulnerabilities and verified files on its infrastructure. However, the company did not confirm how its infrastructure was accessed, whether all exposure has been eliminated, or how many customer systems were affected.
Administrators that used AOMEI Backupper during the reported periods should have security teams assess possible exposure. A Malwarebytes summary says the same infrastructure also serves AnyViewer, but the available reporting does not identify confirmed AnyViewer infections. It notes that the downloader may remove itself after creating persistence, so its absence alone does not establish that a system is clean.
No CVE, affected-version range, or vendor-issued customer remediation advisory was identified in the available reporting.