AOMEI Update Servers Compromised, Malware Inserted via Built‑In Promotion Feature

Researchers in cybersecurity have verified that attackers breached AOMEI’s update infrastructure – the Chinese company that provides backup and disk‑cloning utilities – and exploited its integrated promotion component to push malicious code to unwitting users.

The breach focused on the automatic‑update pathway of AOMEI Backupper, a tool trusted by millions of home and small‑business customers for safeguarding vital data. Because the application periodically shows promotional ads, the perpetrators commandeered that function to deliver a payload disguised as a genuine update.

The probe found that the attackers obtained entry to the server storing the update service’s configuration files. They briefly modified those files so the client would retrieve a malicious executable, then restored the originals. This short‑lived alteration was intended to slip past routine integrity verification and leave scant forensic evidence on the host.

Security analysts monitoring network traffic from AOMEI Backupper instances were the first to detect the malicious code. Odd download URLs and unfamiliar binary signatures prompted a deeper dive, uncovering a trojan that could fetch extra modules and siphon files. Tracing the download origin back to the compromised AOMEI server confirmed a supply‑chain‑type intrusion.

Although the precise count of impacted installations remains unclear, the compromise seems to have lasted only a few hours. AOMEI released a statement admitting the breach, confirming the restoration of the tampered configuration files and the distribution of a clean update to every client. The firm also urges users to check their installation integrity and perform a comprehensive scan with trusted security tools.

The episode joins an expanding roster of supply‑chain attacks aimed at reputable software providers, ranging from major operating‑system patches to specialized utilities. Exploiting the trust between a vendor and its customers enables threat actors to evade many conventional defenses that concentrate solely on endpoint security.

Experts advise firms to implement layered verification methods—like code‑signing validation and out‑of‑band hash checks—particularly for software handling essential system tasks such as backups. At the same time, vendors are being pressed to reinforce server access restrictions, adopt immutable configuration practices, and watch for swift file modifications that may signal tampering.

While the probe proceeds, cybersecurity companies are keeping an eye out for further moves that could show the same group trying to repeat the tactic on other software update streams. The AOMEI incident underscores that even benign‑looking convenience features can become conduits for advanced malware when the supporting infrastructure lacks proper safeguards.