AOMEI Technology’s update servers for its backup software were infiltrated in a supply chain attack, allowing malicious code to be distributed to users. The breach...
Attackers compromised AOMEI Backupper’s update system to deliver malware that could grant remote access to users’ PCs.
What Changed
AOMEI Technology’s update servers for its backup software were infiltrated in a supply chain attack, allowing malicious code to be distributed to users. The breach, confirmed by multiple security sources, involved altering the expected version number and MD5 checksum of update packages to bypass client verification. This manipulation enabled the deployment of malware disguised as a legitimate software update. The incident was identified through analysis by the Google Threat Intelligence Group and corroborated by independent security researchers.
What Is Confirmed
The attack targeted AOMEI Backupper, a widely used backup tool with over 100 million global users. Attackers modified the update infrastructure to redirect users to a malicious server, where they downloaded malware capable of granting remote access to infected systems. The altered version numbers and checksums ensured the malicious payload was accepted by the software’s client. Security experts confirmed that the breach occurred between April and July 2026, with the malware’s distribution detected in late October. No official statement from AOMEI Technology has been released as of this report.
What to Watch or Do Next
Users who have downloaded AOMEI Backupper updates since April 2026 should immediately scan their systems for malware using trusted security tools. Verify the authenticity of update servers by checking the software’s official website for the latest version number and checksum. If a system is suspected to be infected, isolate the device and contact a cybersecurity professional for removal. AOMEI Technology is expected to address the breach by revoking compromised certificates and releasing a patched version of the software.
Frequently Asked Questions
Q1: How did attackers bypass security measures?
Attackers altered the expected version number and MD5 checksum of update packages to trick the software into accepting malicious code. This bypassed standard verification processes.
Q2: What should users do if they suspect an infection?
Users should run a full system scan with antivirus software and check for unusual network activity. If malware is detected, disconnect the device from the internet and seek professional assistance.
Q3: When will AOMEI Technology release a fix?
AOMEI Technology is expected to issue a patched version of the software after confirming the breach, though no official timeline has been announced.