AOMEI Update Channel Abused to Push Malware in Brief Compromise

Key points

• Attackers briefly controlled AOMEI update servers.
• Malware was delivered through the trusted update path.
• Configuration files were altered before being restored.
• No CVE was assigned; the exposure window appears short.

Unknown intruders briefly took control of the update infrastructure used by AOMEI's backup software, turning a trusted maintenance channel into a malware delivery path. The attackers compromised servers, changed configuration files, and pushed malicious payloads to users during a short period. The vendor later restored the altered files.

People and organizations running AOMEI backup software are the main group at risk, particularly anyone who downloaded or applied updates while the servers were under unauthorized control. Updates frequently execute with elevated privileges, so malware arriving this way can avoid ordinary user warnings and look like routine maintenance. The activity also involved a promotional feature in the product, which defenders should include in their review.

The incident matters because it abuses the trust placed in vendor update systems. Even a brief compromise can give attackers a foothold on many endpoints at once, and backup software often sits on systems with sensitive access. No CVE has been assigned, and the severity is best treated as medium given the short duration and the restoration of tampered files.

Administrators should look for signs that endpoints contacted AOMEI update endpoints during the vendor's disclosure window and check for unexpected processes or configuration changes on those hosts. Until the vendor provides a clear timeline and integrity guidance, restrict or monitor automatic updates for this product and verify installations against known-good sources.

Watch for a formal vendor advisory, updated hashes or signatures, and any revised timeline. Review proxy, DNS, and endpoint telemetry for anomalous update traffic, and document which systems received updates during the affected period.

What to do now

1. Inventory all endpoints with AOMEI backup software and identify any that installed or checked for updates during the vendor's disclosed compromise window.
2. Run full endpoint scans on affected hosts and isolate or reimage systems showing unexpected processes, persistence, or configuration changes.
3. Verify AOMEI installations against vendor-provided hashes or signatures; reinstall from clean media if integrity cannot be confirmed.
4. Temporarily block or closely monitor AOMEI update domains until the vendor confirms the channel is clean, and use allowlists for approved update sources.
5. Review proxy, DNS, and firewall logs for connections to AOMEI update endpoints and for suspicious child processes spawned by the backup application.
6. Disable or restrict automatic updates and promotional components in the backup software where policy permits, requiring administrative approval for changes.
7. Subscribe to AOMEI security notifications and document the timeline, affected versions, and remediation actions for audit purposes.

Original source

BleepingComputer