Hackers hijack AOMEI update servers to secretly spread malware
BLUF
A supply-chain compromise of AOMEI's update servers may have allowed attackers to distribute malware to backup-software users while covering their tracks.
NEWS
The attack reportedly abused a built-in promotional feature in AOMEI backup software after hackers accessed the company's update servers. Malicious payloads were delivered through that channel, and configuration files were temporarily modified and then restored to reduce suspicion.
Why I Care
This matters because trusted software updates are a common way for attackers to reach many users at once. Anyone using affected AOMEI backup products could be exposed to malware, data theft, or further network compromise, especially if the promotional feature was enabled by default.
Next Steps
AOMEI users should check official advisories immediately, disable automatic updates and promotional features until a trusted patch is available, and scan endpoints for suspicious files or processes. Security teams should hunt for unexpected changes to backup software configuration files, monitor outbound connections from backup processes, block known malicious domains or IPs once published, and isolate potentially affected systems pending investigation.
Source: BleepingComputer ·