Google and Mandiant say UNC7017 swapped unsigned config files on AOMEI Backupper update servers

Google Threat Intelligence and Mandiant say a group tracked as UNC7017 repeatedly swapped two unsigned config files on AOMEI Backupper's own update servers between May and July, requiring only 5 to 10 minutes per swap to compromise any copy that checked for an update.

Detected & updated continuously · Source: Nebula