Security researchers report that threat actors compromised AOMEI's update servers, exploiting a built-in promotional feature in AOMEI Backupper to distribute malware. The attackers briefly modified configuration files before restoring them to their original state to conceal the intrusion. The full scope of infections and data compromise remains under investigation.

What should defenders do?

AOMEI has not publicly released a security advisory or patch specific to this compromise in the provided excerpt. Mitigation steps recommended by security researchers include: updating AOMEi Backupper to the latest available version, monitoring official AOMEI security channels for advisories, and implementing network segmentation to limit the impact of potential malicious payloads. Users should also review system logs for unusual activity related to the AOMEI Backupper promotional feature.

highMalware

Hackers Hijack AOMEI Update Servers to Spread Malware via Backup Software

Compromised update mechanism leverages built-in promotional feature to distribute malicious payloads

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Hackers Hijack AOMEI Update Servers to Spread Malware via Backup Software

Key Takeaways

Threat actors compromised AOMEI's update servers to distribute malware through AOMEI Backupper.
The attack exploited a built-in promotional feature within the backup software to spread malicious payloads.
Attackers briefly modified configuration files before restoring them to conceal the intrusion.
The full extent of infections and the specific malware involved are still under investigation.

Related Security News

highCyber Attacks

Hackers Exploit Plex2Shell Chain to Deploy Crypto Miners and Linux Backdoor

Threat actors have begun exploiting a chain of four vulnerabilities in Plex Media Server, tracked collectively as Plex2Shell, to deploy cryptocurrency miners and a Linux reverse proxy backdoor. The exploitation activity emerged shortly after a proof-of-concept was published publicly. The researcher boredhackerblog reported the chaining technique, though full technical details and CVE identifiers remain pending disclosure.

The Hacker Newsabout 2 hours ago1 min read