AOMEI Confirms Hackers Hijacked Update Servers to Distribute Malware

AOMEI, the Hong Kong-registered maker of Windows backup tools, confirmed Tuesday that hackers hijacked its update servers to distribute malware. The company stated it has not yet identified or notified customers who were infected during the months-long supply-chain attack, leaving users unaware of the compromise.

According to Recorded Future News, the attackers repeatedly altered configuration files on AOMEI’s update servers between April and July. These modifications redirected the legitimate software to download malware for minutes at a time. This short-burst tampering method effectively evaded traditional point-in-time triage and automated file scanning, as noted by Google researchers.

Context and Background

The confirmation follows coordinated reports published last week by cybersecurity firm ManageEngine and the Google Threat Intelligence Group. ManageEngine researchers first detected the suspicious activity after their software flagged issues at two customers in June. They warned AOMEI of the compromise, but the vendor initially blamed malicious actors intercepting and modifying updates in transit rather than accepting responsibility for server-side issues.

Despite AOMEI’s claim that it investigated and rectified potential vulnerabilities after the initial warning, attackers struck at least twice more. The company stated it was unable to pinpoint the root cause of the breach during that initial investigation. It was only after ManageEngine’s July report provided specific timestamps of the tampering that AOMEI’s team could analyze server logs and compare files to find traces of the intrusion.

AOMEI said it updated the server after identifying the traces and has found no malicious files since. However, the company did not address ManageEngine’s account of its initial explanation. AOMEI claimed that both Google and ManageEngine told it the issue was resolved, although ManageEngine’s report states it had not independently verified that attackers lost access to the infrastructure.

Who Is Affected

Google said it has notified the victims it identified, which span IT services, telecommunications, and higher education sectors. The affected organizations are located in almost a dozen countries, including the United States, Australia, India, and Brazil. AOMEI has not yet identified or notified all customers who may have been infected with the malware during the period between April and July.

What should you do?

Organizations using AOMEI backup tools should verify the integrity of their software installations and check for any unexpected configuration changes. Security teams should monitor for anomalous outbound traffic or connections to unknown servers, which could indicate compromised update processes. Users should also review server logs for any unauthorized access or file modifications during the April to July timeframe.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: AOMEI

• Verify the integrity of current AOMEI software installations by comparing file hashes against known good versions from official sources.
• Monitor network logs for unusual outbound connections or data exfiltration attempts that may indicate compromised update mechanisms.
• Review server access logs for unauthorized changes to configuration files, particularly during the April to July window mentioned in reports.
• Ensure endpoint detection and response tools are updated to recognize signatures associated with the malware distributed in this supply-chain attack.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How long did hackers have access to AOMEI's update servers?

Hackers altered configuration files on the servers between April and July, redirecting software to download malware for minutes at a time during those periods.

Did AOMEI admit fault for the breach?

AOMEI confirmed hackers altered files but initially blamed interception in transit; it later found traces of intrusion after receiving specific timestamps from ManageEngine.

Which countries were affected by this malware distribution?

Victims spanned almost a dozen countries including the U.S., Australia, India, and Brazil, affecting sectors like IT services, telecommunications, and higher education.