AOMEI Backup Software Update Infrastructure Compromised to Distribute Malware

According to BleepingComputer, attackers reportedly compromised servers belonging to AOMEI, a vendor of backup and disk-management software, and abused a built-in promotional feature within the software to distribute malware. The report states the attackers briefly altered configuration files to push the malicious content, then restored those files to their original state afterward in an apparent attempt to conceal the activity.

Why It Matters

AOMEI's products are widely used consumer and small-business backup tools, meaning any installed base that checks in against the compromised promotional/update mechanism could have been exposed during the window the configuration was tampered with. This is a software supply-chain style compromise: the malicious delivery rode on a feature end users already trusted, rather than a traditional phishing or exploit vector. Because the attackers reportedly restored the original configuration afterward, the window of exposure and its exact boundaries are not yet well defined based on current public reporting.

What Defenders Should Watch For

• Inventory whether AOMEI products are present in your environment and check vendor advisories for an official timeline and affected versions.
• Review outbound network activity from hosts running AOMEI software for connections to unexpected or newly observed domains/IPs around the reported timeframe.
• Hunt for unexpected child processes, dropped binaries, or persistence mechanisms spawned by AOMEI application processes or their update/promotional components.
• Monitor for configuration or update-channel file changes associated with the software that don't correspond to a legitimate vendor-initiated update.
• Treat any AOMEI-related alerts with elevated scrutiny until the vendor confirms scope and remediation.

This is developing intel based on a single report, and specifics such as the malware family, affected versions, and full timeline have not been independently confirmed here. We'll track this story as more details emerge. Read the original report at BleepingComputer.