AOMEI Update Servers Compromised, Malware Delivered via Built‑In Promotion Feature

Security researchers have verified that threat actors breached the update infrastructure of AOMEI, the Chinese company behind popular backup and disk‑cloning utilities, and exploited a built‑in promotional component to push malicious code to unsuspecting users.

The compromise focused on the automatic update stream of AOMEI Backupper, a tool trusted by millions of home and small‑business users for safeguarding vital data. The application contains a routine that periodically shows promotional offers; the attackers seized this mechanism to slip in a payload disguised as a legitimate update.

Investigators found that the attackers accessed the server storing the configuration files for the update service. They briefly modified those files to redirect the client software to a malicious executable, then restored the originals. This short‑lived alteration was intended to dodge standard integrity checks and leave only minimal forensic evidence on the server.

The malicious payload was initially detected by analysts watching network traffic from AOMEI Backupper installations. Odd download URLs and unexpected binary signatures prompted a deeper dive, uncovering a trojan capable of pulling additional modules and exfiltrating files. The download source was traced back to the compromised AOMEI server, confirming a supply‑chain‑style attack.

The precise count of affected installations remains unknown, but the window of exploitation appears to have lasted only a few hours. AOMEI has released a statement acknowledging the breach, confirming that the altered configuration files have been restored and that a clean update package has been distributed to all clients. The company also urges users to verify their installations' integrity and run a full system scan with reputable security software.

This episode joins a growing roster of supply‑chain compromises aimed at trusted software distributors, ranging from major operating‑system updates to niche utilities. By hijacking the trust relationship between a vendor and its user base, attackers can sidestep many conventional defenses that concentrate on endpoint protection.

Experts advise organizations to employ multi‑layered verification methods, such as code‑signing validation and out‑of‑band hash checks, especially for software that performs critical functions like backups. Vendors are being pressed to reinforce server access controls, adopt immutable configuration management, and monitor for rapid file changes that could signal tampering.

As the probe proceeds, cybersecurity firms continue to watch for any follow‑up activity that might indicate the same actors are trying to replicate the technique against other software update channels. The AOMEI incident serves as a reminder that even well‑intentioned convenience features can become conduits for sophisticated malware when the underlying infrastructure is insufficiently secured.