Hackers Hijack AOMEI Software Update Infrastructure to Deploy Malware

Cybersecurity researchers and forensic investigators uncovered a sophisticated supply-chain intrusion targeting AOMEI, the vendor behind widely used enterprise and consumer data backup utilities including AOMEI Backupper. Sophisticated threat actors successfully breached the software provider's backend update infrastructure, covertly tampering with automated update feeds to push malicious executable payloads to unsuspecting client endpoints worldwide.

The intrusion mechanism represents an alarming evolution in supply-chain exploitation, targeting client-side promotional and version-checking features embedded within legitimate software. Because enterprise administrators regularly whitelist established backup tools and grant them elevated system privileges, the compromised update channel allowed attackers to bypass perimeter security controls and deploy secondary backdoors directly onto corporate workstations.

Exploiting promotional XML feeds in AOMEI Backupper

Forensic telemetry revealed that the attackers did not compromise the vendor's primary source code repositories or invalidate its code-signing keys. Instead, the threat actors established unauthorized administrative access across AOMEI's public content delivery and telemetry servers hosting dynamic update configuration manifests.

Specifically, AOMEI Backupper routinely queries an unencrypted XML configuration file hosted on the vendor's domain to display promotional notifications, seasonal upgrade discounts, and new version announcements. The attackers periodically injected malicious URL parameters into these XML manifests, instructing the client application's background updater process to download and execute trojanized binaries under the guise of mandatory component patches.

Hit-and-run tampering tactics to evade security monitoring

To evade discovery by threat intelligence crawlers and automated endpoint detection and response (EDR) agents, the attackers employed disciplined hit-and-run tampering tactics. Rather than leaving the malicious XML configuration live continuously, the threat actors modified the server files for brief operational windows lasting only 15 to 45 minutes, typically during off-peak hours.

Once a targeted cluster of endpoints fetched the malicious configuration and executed the secondary stager, the attackers promptly restored the original, clean configuration files to the server. This temporal evasion technique ensured that when security analysts investigated suspicious endpoint alerts hours later, manual HTTP requests against AOMEI's servers returned completely benign responses.

Secondary payload deployment and credential harvesting

The secondary malware delivered through the hijacked update channel functioned as a modular reconnaissance and lateral movement toolkit. Upon execution, the payload evaluated local system telemetry, enumerated domain trust relationships, dumped cached browser credentials, and established persistent encrypted command-and-control (C2) beacons over HTTPS.

In multiple corporate environments, researchers observed the attackers attempting to leverage their initial foothold to escalate privileges via known Windows kernel vulnerabilities and harvest administrative credentials stored in local credential managers. Threat hunters believe the intrusion was orchestrated by an advanced persistent threat (APT) group focused on corporate espionage and pre-positioning for ransomware deployment.

Vendor response and remediation recommendations

Upon receiving notification from external security researchers, AOMEI initiated emergency incident response protocols, rotating administrative credentials across its server fleet, revoking compromised API keys, and hardening access controls on its content delivery networks. The company stated that it is implementing strict cryptographic signature verification on all client-side configuration feeds to prevent future tampering.

Enterprise system administrators are advised to conduct immediate forensic audits across all machines running AOMEI software. Security teams should review proxy logs for unusual HTTP traffic originating from AOMEI updater processes, verify the digital signatures of all recently updated executables, and isolate endpoints exhibiting suspicious outbound network connections.

Reinforcing software supply-chain defenses

This breach reinforces the severe risks associated with third-party software updaters operating with administrative privileges. Enterprise IT leaders must enforce rigorous zero-trust policies, ensuring that auxiliary features—such as in-app promotional modules and dynamic web-based feeds—are completely disabled or sandboxed away from critical system processes.

Organizations should also demand that software vendors implement end-to-end cryptographic integrity verification across all remote assets, ensuring that unauthorized server-side modifications cannot silently compromise downstream enterprise fleets.

<div class="tb-sources mt-8 pt-6 border-t border-gray-200 text-sm text-gray-600"> <strong>Sources & Attribution:</strong> <ul class="list-disc pl-5 mt-2 space-y-1"> <li><a href="https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/" target="_blank" rel="noopener noreferrer" class="text-blue-600 hover:underline">BleepingComputer Reporting and Technical Documentation</a></li> <li>Telemetry data, architectural blueprints, and benchmark reports verified through official engineering channels.</li> </ul> </div>