A new release addresses an earlier compromise

AOMEI released Backupper 8.5.1 on October 19 after an investigation into tampering with its update infrastructure. The company says it remediated the upgrade server in July, moved update services and disabled affected update mechanisms. Its assessment of the incident’s full impact remains ongoing. Customers therefore face two separate tasks: deploying the vendor’s corrective release and examining whether earlier activity reached their computers.

An unusually short opportunity for detection

Google Threat Intelligence Group and Mandiant reported October 15 that attackers repeatedly altered update configurations for five to ten minutes between April and July, restoring legitimate content afterward. The researchers tracked the activity as UNC7017 and identified affected organizations in sectors including telecommunications and higher education. Their observations do not establish that every installation was compromised. AOMEI identifies three observed exposure windows: May 28, July 16 and July 20. Google’s researchers caution that their visibility may not include every tampering event.

Reconstruct what each endpoint actually did

Our analysis is that the useful unit of investigation is the individual computer and its activity history. An MSP should start with an inventory of client installations, then establish which retained endpoint, proxy and software-management records can answer questions about the relevant period. Preserve those records before routine retention settings remove them. A present-day software version provides a useful maintenance checkpoint, but it cannot describe an earlier download or execution. Equally, an installation record alone does not prove that a malicious payload ran.

Make uncertainty an operational record

For a telecommunications provider, separate machines supporting business operations from devices that administer network infrastructure before assigning investigation priorities. A university should identify who owns centrally managed computers and who can investigate departmental systems; gaps between those groups can leave an exposure review incomplete. These are suggested triage boundaries, not claims about any particular organization in the research. Small businesses using an MSP can request a short account of what was checked, which dates the evidence covers and what remains unknown. Where historical records are unavailable, record that limitation rather than replacing it with a clean bill of health. The work should finish with an accountable decision for each affected inventory group: evidence reviewed, further investigation required, or an explicit information gap. That gives management a defensible basis for follow-up while keeping software maintenance moving.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

TelecommunicationsEducationSmall business
Suggest a correction →