Hackers Hijack AOMEI Update Servers to Distribute Malware

Attack Timeline and Discovery

In early 2024 security researchers observed a sudden spike in malicious files that claimed to be updates for AOMEI Backupper, a popular Windows backup utility. The files were signed with a legitimate certificate, yet they contained a hidden payload that installed a remote access trojan on the victim’s machine.

Initial analysis traced the source to AOMEI’s own update infrastructure. The attackers had gained access to the server that hosts the software’s automatic update feature. By briefly modifying the server‑side configuration, they were able to replace the genuine update package with a compromised version. After the malicious files were delivered, the configuration was restored to its original state, making the breach difficult to detect.

Technical Details of the Malware Delivery

The malicious update was crafted to appear identical to the official release. It used the same version number, installer name, and digital signature. The hidden payload was embedded in a resource section that is typically ignored by the installer, allowing it to execute silently after the user launched the update.

Key techniques used by the attackers

Server configuration tampering: The attackers altered the JSON file that maps version numbers to download URLs. The change lasted only a few hours, enough to serve the malicious package to thousands of users.
Code signing abuse: By obtaining a legitimate code‑signing certificate from a trusted authority, the malicious binary passed Windows’ signature verification checks.
Stealth installation: The trojan was designed to run in the background, establish a command and control channel, and avoid detection by common antivirus products.

Impact on Users and Organizations

Because AOMEI Backupper is widely used by small businesses and home users for data protection, the breach had a broad reach. Victims reported symptoms such as unexpected network traffic, new startup entries, and the appearance of unknown processes.

Data exfiltration risk: The remote access trojan could copy sensitive files to an external server.
Ransomware escalation: In some cases, the trojan was used as a foothold for ransomware deployment.
Loss of trust: Users questioned the security of automatic update mechanisms in consumer software.

Response from AOMEI and the Security Community

AOMEI issued a public statement within 24 hours of the discovery, acknowledging the breach and confirming that the compromised files had been removed from all distribution channels. The company also released an emergency patch that resets the update configuration and forces a re‑verification of all future updates.

Security firms quickly published analysis reports. The Cybersecurity and Infrastructure Security Agency issued an advisory warning users to verify the source of any AOMEI update before installation. Kaspersky Lab added detection signatures for the specific trojan variant.

Steps taken by AOMEI

Enhanced server authentication with multi‑factor checks.
Implemented a checksum verification step for all update files before they are served.
Started a bug bounty program to encourage external security testing.

Lessons Learned and Prevention Strategies

The incident highlights several best practices that both software vendors and end users should adopt.

For Software Vendors

Adopt zero‑trust networking principles for internal servers, limiting access to only essential personnel.
Use hardware security modules to protect code‑signing keys from theft.
Publish cryptographic hashes of update files on a separate, tamper‑proof website.
Conduct regular penetration testing focused on the update delivery pipeline.

For End Users

Verify the digital signature of any installer before running it.
Consider disabling automatic updates for critical backup tools and instead download updates manually from the vendor’s official site.
Maintain up‑to‑date endpoint protection that can detect anomalous behavior even when a file is signed.
Back up important data to multiple locations, including offline media, to reduce impact of a potential ransomware event.

By following these guidelines, the risk of a similar supply‑chain compromise can be reduced.

Future Outlook

Supply‑chain attacks on legitimate software are becoming more frequent as attackers recognize the trust users place in signed updates. The AOMEI incident serves as a reminder that security must be embedded at every stage of the software lifecycle, from development to distribution. Ongoing collaboration between vendors, security researchers, and government agencies will be essential to detect and mitigate such threats before they reach end users.