AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Between April and July, AOMEI Backupper served malware to its users multiple times in short-burst supply chain compromises, security researchers warn.
AOMEI Backupper is Windows backup, sync, and disk cloning software, available in free and paid editions for home users, businesses, and Windows Server environments. AOMEI says its products are used by more than 186 million people worldwide.
Unlike typical supply chain attacks, this campaign relied on short-lived tampering windows to serve the CrossRoad downloader and the ShinyRoad backdoor.
“Each tampering window remained active for only five to ten minutes before reverting to authentic versions,” report Google Cloud’s Google Threat Intelligence Group (GTIG) and Mandiant, which investigated the attack alongside ManageEngine Threat Analysis Lab (METAL).
The attacks hit all systems that fetched the modified AOMEI Backupper packages during the attack windows, suggesting an opportunistic campaign rather than a targeted one.
However, throughout the investigation, Google Cloud identified higher education, IT...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
