In mid-2026, cybercriminals breached the update infrastructure of AOMEI, a developer of data backup and recovery software, to covertly distribute malware. The intrusion occurred between April and July, targeting systems used by customers relying on the company's tools for system protection. Attackers exploited a legitimate promotional feature within the software to deliver malicious payloads without raising immediate suspicion.
The hackers gained access to AOMEI's servers and modified configuration files tied to the software's update and notification mechanisms. By altering these files, they redirected update requests to servers hosting malware, which was then downloaded and executed on users' machines during routine software checks. After the malicious files were delivered, the attackers restored the original configuration to erase traces of their tampering, making the intrusion difficult to detect through standard audits.
The attackers used a short-lived manipulation strategy, changing server settings only briefly during each malicious campaign window. This allowed them to infect systems while minimizing the window for security teams to notice anomalies. Because the changes were reverted quickly, logs appeared normal, and the malicious activity blended with legitimate update traffic. The use of a built-in promotional channel meant the malicious downloads appeared as expected software communications, further reducing the chance of user or system intervention.
By targeting a trusted software update process, the attackers bypassed many traditional defenses that focus on blocking unknown executables or suspicious websites. Supply chain compromises like this one are particularly dangerous because they exploit the implicit trust users place in legitimate software vendors. The method also allowed broad reach, as any user running the affected version of AOMEI's backup tool during the compromise period was potentially exposed, regardless of their individual security practices.
What type of malware was distributed through the compromised servers? While the specific malware variant was not disclosed in reports, the payload was designed to execute silently upon download, likely enabling data theft, system surveillance, or further network infiltration.
How did AOMEI respond after discovering the breach? AOMEI stated that it identified the unauthorized changes, removed the malicious configurations, and restored server integrity. The company also advised users to ensure their software was updated to the latest version to prevent exposure.
Could users have detected the attack on their own systems? Detection would have been challenging without advanced monitoring, as the malware used trusted update channels and the server changes were temporary. Users are encouraged to maintain updated security software and review network logs for unusual outbound connections during update cycles.